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Abstract 

We study the trade-offs between strategyproofness and other desiderata, such as 
efficiency or fairness, that often arise in the design of random ordinal mechanisms. 

We use e-approximate strategyproofness to define manipulability , a measure to 
quantify the incentive properties of non-strategyproof mechanisms, and we in¬ 
troduce the deficit , a measure to quantify the performance of mechanisms with 
respect to another desideratum. When this desideratum is incompatible with 
strategyproofness, mechanisms that trade off manipulability and deficit optimally 
form the Pareto frontier. Our main contribution is a structural characterization 
of this Pareto frontier, and we present algorithms that exploit this structure to 
compute it. To illustrate its shape, we apply our results for two different desiderata, 
namely Plurality and Veto scoring, in settings with 3 alternatives and up to 18 
agents. 
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1. Introduction 


In many situations, a group of individuals has to make a collective decision by selecting 
an alternative: who should be the next president? who gets a seat at which public school? 
or where to build a new stadium? Mechanisms are systematic procedures to make such 
decisions. Formally, a mechanism collects the individuals’ (or agents’ ) preferences and 
selects an alternative based on this input. While the goal is to select an alternative that 
is desirable for society as a whole, it may be possible for individual agents to manipulate 
the outcome to their own advantage by being insincere about their preferences. However, 
if these agents are lying about their preferences, the mechanism will have difficulty in 
determining an outcome that is desirable with respect to the true preferences. Therefore, 
incentives for truthtelling are a major concern in mechanism design. In this paper, we 
consider ordinal mechanisms with random outcomes. Such mechanisms collect preference 
orders and select lotteries over alternatives. We formulate our results for the full domain 
where agents can have any weak or strict preferences, but our results continue to hold 
on many domain restrictions, including the domain of strict preferences, the assignment 
domain, and the two-sided matching domain. 

1.1. The Curse of Strategyproofness 

Strategyproof mechanisms make truthful reporting a dominant strategy for all agents and 
it is therefore the “gold standard” among the incentive concepts. However, the seminal 
impossibility results by Gibbard (1973) and Sattert-hwaite (1975) established that if 
there are at least three alternatives and all strict preference orders are possible, then the 
only unanimous and deterministic mechanisms that are strategyproof are dictatorships. 
Gibbard (1977) extended these insights to mechanisms that involve randomization 
and showed that all strategyproof random mechanisms are probability mixtures of 
strategyproof unilateral and strategyproof duple mechanisms. These results greatly 
restrict the design space of strategyproof mechanisms. In particular, many common 
desiderata are incompatible with strategyproofness, such as Condorcet consistency, 
stability of matchings, or egalitarian fairness. 

When a desideratum is incompatible with strategyproofness, designing “ideal” mecha¬ 
nisms is impossible. For example, suppose that our goal is to select an alternative that 
is the first choice of as many agents as possible. The Plurality mechanism selects an 
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alternative that is the first choice for a maximal number of agents. Thus, it achieves our 
goal perfectly. At the same time, Plurality and any other mechanism that achieves this 
goal perfectly must be manipulable. In contrast, the Random Dictatorship mechanism 
selects the first choice of a random agent. It is strategyproof but there is a non-trivial 
probability that it selects “wrong” alternatives. If Plurality is “too manipulable” and 
Random Dictatorship is “wrong too often,” then trade-offs are necessary. In this paper, 
we study mechanisms that make optimal trade-offs between (non-)manipulability and 
another desideratum. Such mechanisms form the Pareto frontier as they achieve the 
desideratum as well as possible, subject to a given limit on manipulability. 

1.2. Measuring Manipulability and Deficit 

In order to understand these trade-offs formally, we need measures for the performance 
of mechanisms in terms of incentives and in terms of the desideratum. 

Approximate Strategyproofness and Manipulability A strategyproof mechanism does 
not allow agents to obtain a strictly positive gain from misreporting. Approximate 
strategyproofness is a relaxation of strategyproofness: instead of requiring the gain from 
misreporting to be non-positive, ^-approximate strategyproofness imposes a small (albeit 
positive) upper bound e on this gain. The economic intuition is that- if the potential 
gain is small, then agents might stick to truthful reporting (e.g., due to cognitive cost). 
To obtain a notion of approximate strategyproofness for ordinal mechanisms, we follow 
earlier work and consider agents with von Neumann-Morgenstern utility functions that 
are bounded between 0 and 1 (Birrell and Pass, 2011; Carroll, 2013). This allows 
the formulation of a parametric measure for incentives: the manipulability e{<p) of a 
mechanism ip is the smallest bound e for which ip is ^-approximately strategyproof. 

Desideratum Functions and Deficit By allowing higher manipulability, the design 
space of mechanisms grows. This raises the question how the new freedom can be 
harnessed to improve the performance of mechanisms with respect to other desiderata. 
To measure this performance we introduce the deficit. 

We first illustrate its construction via an example: consider the desideratum to select 
an alternative that is the first choice of as many agents as possible. For any alternative a 
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it is natural to think of “the share of agents for whom a is the first choice” as the value 
that society derives from selecting a. For some alternative (6, say) this value is maximal. 
Then the deficit of a is the difference between the share of agents with first choice b and 
the share of agents with first choice a. A Dictatorship mechanism may select alternatives 
with strictly positive deficit. We define the deficit of this mechanism to be the highest 
deficit of any alternatives that it selects across all possible preference profiles. 

In general, any notion of deficit is constructed in three steps: first, we express the 
desideratum via a desideratum function , which specifies the value to society from selecting 
a given alternative at a given preference profile. Since we consider random mechanisms, 
we extend desideratum functions to random outcomes by taking expectations. 1 Second, 
we define the deficit of outcomes based on the desideratum function. Third, we define 
the deficit of mechanisms based on the deficit of outcomes. 2 For any mechanism ip, we 
denote its deficit by 5{p). 


1.3. Optimal Mechanisms and the Pareto Frontier 

Together, manipulability e(p) and deficit 5{<p) yield a way to compare different mecha¬ 
nisms in terms of incentives and their performance with respect to some desideratum. 
Specifically, the signature of a mechanism p is the point (e(p), S(p)) in the unit square 
[0,1] x [0,1]. Figure 1 illustrates this comparison. Ideally, a mechanism would be 
strategyproof and would always select the most desirable alternatives. This corresponds 
to a signature in the origin (0,0). However, for desiderata that are incompatible with 
strategyproofness, designing ideal mechanisms is not possible. Instead, there exist strate¬ 
gyproof mechanisms which have a non-trivial deficit, such as Random Dictatorship; and 
there exist value maximizing mechanisms which have non-trivial manipulability, such as 

x Many important desiderata can be expressed via desideratum functions, including binary desiderata 
such as unanimity, Condorcet consistency, egalitarian fairness, Pareto optimality, v-rank efficiency 
of assignments, stability of matchings, any desideratum specified via a target mechanism (or a target 
correspondence), or any logical combination of these. Moreover, it is possible to express quantitative 
desiderata, such as maximizing positional score in voting, maximizing v-rank value of assignments, 
or minimizing the number of blocking pairs in matching. We discuss the generality and limitations 
of desideratum functions in Section E. 

2 In the example we considered absolute differences to construct the deficit of outcomes and we considered 
the worst-case deficit to construct the deficit of mechanisms. Alternatively, we can consider relative 
differences and we can also define an ex-ante deficit of mechanisms. Many meaningful notions of 
deficit can be constructed in this way (see Appendix A); the results in this paper hold for any of 
them. 
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Figure 1: Example signatures of mechanisms in a manipulability-deficit-plot. 

Plurality (if the goal is to select an alternative that is the first choice of as many agents 
as possible). Finally, there may exist mechanisms that have intermediate signatures, 
such as tt in Figure 1. Choosing between these mechanisms means to make trade-offs. 

Finding Optimal Mechanisms Naturally, we want to make optimal trade-offs. A 
mechanism is optimal at manipulability bound £ if it has manipulability of at most £ 
and it has the lowest deficit among all such mechanisms. For a given e we denote by 
OPT(e) the set of all mechanisms that are optimal at e. Given an optimal mechanism, it 
is not possible to reduce the deficit without increasing manipulability at the same time. 
In this sense, the set of all optimal mechanisms constitutes the Pareto frontier. Our 
first result yields a finite set of linear constraints that is equivalent to ^-approximate 
strategyproofness. This equivalence allows us to formulate the linear program FindOpt, 
whose solutions uniquely identify the optimal mechanisms at e. 

Trade-offs via Hybrid Mechanisms Given two mechanisms, mixing them suggests 
itself as a natural approach to create new mechanisms with intermediate signatures. 
Formally, the f3-hybrid of two mechanisms ip and if is the /3-convex combination of 
the two mechanisms. Such a hybrid can be implemented by first collecting the agents’ 
preference reports, then randomly deciding to use if or ip with probabilities ft and 1 — /3, 
respectively. If p has lower manipulability and if has lower deficit, then one would 
expect their hybrid to inherit a share of both properties. Our second result in this paper 
formalizes this intuition: we prove that the signature of a /3-hybrid is always weakly 
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preferable on both dimensions to the /3 -convex combination of the signatures of the two 
original mechanisms. This insight teaches us that interesting intermediate mechanisms 
can indeed be obtained via mixing. 

Our result has important consequences for the Pareto frontier: it implies that the first 
unit of manipulability that we sacrifice yields the greatest return in terms of a reduction 
of deficit. Furthermore, the marginal return on further relaxing incentive requirements 
decreases as the mechanisms become more manipulable. This is good news for mechanism 
designers because it means that the most substantial improvements already arise by 
relaxing strategyproofness just “a little bit.” 

Structural Characterization of the Pareto Frontier To fully understand the possible 
and necessary trade-offs between manipulability and deficit, we need to identify the 
whole Pareto frontier across all manipulability bounds. Our main result in this paper 
is a structural characterization of this Pareto frontier. We show that there exists a 
finite set £q < ... < £k of supporting manipulability bounds , such that between any 
two of them (£k-i and £k, say) the Pareto frontier consists precisely of the hybrids of 
two mechanisms that are optimal at £k-i and £}., respectively. Consequently, the two 
building blocks of the Pareto frontier are, first, the optimal mechanisms at the supporting 
manipulability bounds £}■ and, second, the hybrids of optimal mechanisms at adjacent 
supporting manipulability bounds for any intermediate £ =£ £k- Thus, the Pareto frontier 
can be represented concisely in terms of a finite number of optimal mechanisms and 
their hybrids. In combination with the linear program FindOpt, we can exploit this 
characterization to compute the whole Pareto frontier algorithmically. 

In summary, we provide a novel perspective on the possible and necessary trade-offs 
between incentives and other desiderata. Our results unlock the Pareto frontier of random 
mechanisms to analytic, axiomatic, and algorithmic exploration. 

2. Related Work 

Severe impossibility results restrict the design of strategyproof ordinal mechanisms. The 
seminal Gibbard-Satterthwaite Theorem (Gibbard, 1973; Satterthwaite, 1975) established 
that if all strict preferences over at least 3 alternatives are possible, then the only 
unanimous, strategyproof, and deterministic mechanisms are dictatorial, and Gibbard 
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(1977) extended this result to random mechanisms. Thus, many important desiderata are 
incompatible with strategyproofness, such as selecting a Condorcet winner or maximizing 
Borda count (Pacuit, 2012). Similar restrictions persist in other domains: in the random 
assignment problem, strategyproofness is incompatible with rank efficiency (Featherstone, 
2011), and in the two-sided matching problem, strategyproofness is incompatible with 
stability (Roth, 1982). 

Many research efforts have been made to circumvent these impossibility results and to 
obtain better performance on other dimensions. One way to reconcile strategyproofness 
with other desiderata is to consider restricted domains. Moulin (1980) showed that in 
the single-peaked domain, all strategyproof, anonymous, and efficient mechanisms are 
variants of the Median mechanism with additional virtual agents, and Ehlers, Peters and 
Storcken (2002) extended this result to random mechanisms. Chatterji, Sanver and Sen 
(2013) showed that a semi-single-peaked structure is almost the defining characteristic of 
domains that admit the design of strategyproof deterministic mechanisms with appealing 
properties; an analogous result for random mechanisms is outstanding. 

An alternative way to circumvent impossibility results is to continue working in full 
domains but to relax the strategyproofness requirement “a little bit.” This can enable 
the design of mechanisms that come closer to achieving a given desideratum but still have 
appealing (albeit imperfect) incentive properties. Mennle and Seuken (20176) introduced 
partial strategyproofness, a relaxation of strategyproofness that has particular appeal in 
the assignment domain. Azevedo and Budisli (2015) proposed strategyproofness in the 
large, which requires that the incentives for any individual agent to misreport should 
vanish in large markets. However, strategyproofness in the large is unsuited for the exact 
analysis of finite settings which we perform in this paper. Instead, we follow Birrell and 
Pass (2011) and Carroll (2013), who used approximate strategyproofness for agents with 
bounded vNM utility functions to quantify manipulability of non-strategyproof ordinal 
mechanisms and derived asymptotic results. We also use approximate strategyproofness 
but we give exact results for finite settings. 

Some prior work has considered trade-offs explicitly. Using efficiency notions based 
on dominance relations, Aziz, Brandt and Brill (2013) and Aziz, Brandi and Brandt 
(2014) proved compatibility and incompatibility of various combinations of incentive 
and efficiency requirements. Procaccia (2010) considered an approximation ratio based 
on positional scoring and gave bounds on how well strategyproof random mechanisms 


7 


can approximate optimal positional scores as markets get large. While he found most 
of these to be inapproximable by strategyproof mechanisms, Birrell and Pass (2011) 
obtained positive limit results for the approximation of deterministic target mechanisms 
via approximately strategyproof random mechanisms. In (Mennle and Seuken, 2017a) 
we studied how hybrid mechanisms make trade-offs between startegyproofness (in terms 
of the degree of strategyproofness ) and efficiency (in terms of dominance ) in random 
assignment. While hybrid mechanisms also play a central role in our present paper, we 
consider general ordinal mechanisms and different measures (i.e., manipulability and 
deficit). 

3. Formal Model 

Let N be a set of n agents and M be a set of m alternatives , where the tuple (IV, M) 
is called a setting. Each agent i e N has a preference order Pi over alternatives, where 
Pi : a > b, Pi : a > b, and Pi : a ~ b denote weak preference, strict preference, and 
indifference, respectively, and V denotes the set of all preference orders. For agent i’s 
preference order P. t , the rank of alternative j under Pi is the number of alternatives that 
i strictly prefers to j plus 1, denoted rankp^j). 3 A preference profile P = ( Pi, P-i ) is 
a collection of preference orders from all agents, and P_j are the preference orders of 
all other agents, except i. A (random) mechanism is a mapping ip : V N —» A (M). Here 
A(M) is the space of lotteries over alternatives, and any x e A(M) is called an outcome. 

We extend agents’ preferences over alternatives to preferences over lotteries via von 
Neumann-Morgenstern utility functions: each agent i e N has a utility function Ui : 
M —> [0,1] that represents their preference order, i.e., ufa) ^ Ui(b) holds whenever 
Pi : a > b. Note that utility functions are bounded between 0 and 1, so that the model 
admits a non-degenerate notion of approximate strategyproofness (see Remark 2). We 
denote the set of all utility functions that represent the preference order P, : by C/p.. 

Remark 1. We formulate our results for the full domain but they naturally extend to a 
variety of domains, including the domain of strict preferences, the assignment domain, 
and the two-sided matching domain (see Appendix E). 


3 1 is added to ensure that first choice alternatives have rank 1, not 0. 



4. Approximate Strategyproofness and Manipulability 


Our goal in this paper is to study mechanisms that trade off manipulability and other 
desiderata optimally. For this purpose we need measures for the performance of different 
mechanisms with respect to the two dimensions of this trade-off. In this section, we 
review approximate strategyproofness, derive a measure for the incentive properties of 
non-strategyproof mechanisms, and present our first main result. 

4.1. Strategyproofness and Approximate Strategyproofness 

The most demanding incentive concept is strategyproofness. It requires that truthful 
reporting is a dominant strategy for all agents. For random mechanisms, this means that 
truthful reporting always maximizes any agent’s expected utility. 

Definition 1 (Strategyproofness). Given a setting (N,M), a mechanism ip is strate- 
gyproof if for any agent i e N, any preference profile (P t , P-i) e V N , any utility tq s Up i 
that represents Pi, and any misreport P[ e V, we have 

Yj “i(i) ■ teW . p - 0 - v s (Pi, p- <)) <o. (i) 

jeM 

The left side of (1) is the change in its own expected utility that i can affect by falsely 
reporting P[ instead of reporting P t . For later use, we denote this difference by 

e{ui, (Pp P-i), P’, <p) = Yi P -i) - p -i )) • ( 2 ) 

jeM 

The fact that e(ui, (Pi, P-i), P[, p>) is upper bounded by 0 for strategyproof mechanisms 
means that deviating from the true preference report weakly decreases expected utility 
for any agent in any situation, independent of the other agents’ reports. Conversely, if a 
mechanism ip is not strategyproof, there necessarily exists at least one situation in which 
e(ui, (Pi, P-i), P[, ip) is strictly positive. Imposing a different bound leads to the notion 
of approximate strategyproofness (Birrcll and Pass, 2011; Carroll, 2013). 

Definition 2 (e -Approximate Strategyproofness). Given a setting (N,M) and a bound 
£ E [0,1], a mechanism ip is e-approximately strategyproof if for any agent i e N, 
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any preference profile (Pi, P-i) e V N , any utility e Up i that represents Pi, and any 
misreport P/ 6 P, we have 

e(«i, 0^, V?) = Xj P -i) ~ Vj( p i, P-i )) < £■ (3) 

jeM 

This definition is analogous to Definition 1 of strategyproofness, except that the upper 
bound in (3) is e instead of 0. Thus, 0-approximate strategyproofness coincides with 
strategyproofness. Furthermore, the gain never exceeds 1, which makes 1-approximate 
strategyproofness a void constraint that is trivially satisfied by any mechanism. 

The interpretation of intermediate values of e s (0,1) is more challenging. Unlike 
utilities in quasi-linear domains, vNM utilities are not comparable across agents. Thus, 
we cannot simply think of e as the “value” (e.g., in dollars) that an agent can gain by 
misreporting. Instead, e is a relative bound: since Ui is between 0 and 1, a change of 
magnitude 1 in expected utility corresponds to the selection of an agent’s first choice 
instead of that agent’s last choice. Thus, “1” is the maximal gain from misreporting 
that any agent could obtain under an arbitrary mechanism. The bound e is the share of 
this maximal gain by which any agent can at most improve its expected utility under an 
e -approximately strategyproof mechanism. 

Remark 2. The bounds on utilities are essential for ^-approximate strategyproofness 
to be a useful relaxation of strategyproofness for ordinal mechanisms. Suppose that a 
non-strategyproof mechanism p allows a gain of e(ui, (P i} P-i), P[, p) > 0. Then scaling 
the utility function u t by a factor a > 1 results in a linear increase of this gain. Thus, 
^-approximate strategyproofness for unbounded utilities would imply strategyproofness. 

4.2. Manipulability 

If p is ^-approximately strategyproof, then it is also e'~ approximately strategyproof for 
any e' 5= e. Thus, lower values of e correspond to stronger incentives. With this in mind, 
we define the manipulability of a mechanism. 

Definition 3 (Manipulability). Given a setting (. N,M) and mechanism p, the manipu¬ 
lability of p (in the setting (N,M)) is given by 

e(p) = min-jV e [0,1] : p is e'-appraxirnately strategyproof in (N, M )}. (4) 
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Intuitively, e(p) is the lowest bound s' for which p is e'- approximately strategyproof. 
This minimum is in fact attained because all inequalities from (3) are weak. Note that 
in a different setting ( N',M' ), the manipulability may vary. However, for all statements 
in this paper, a setting is held fixed and the value e(p) should be understood as the 
manipulability of the mechanism p in the fixed setting from the respective context. 

4.3. An Equivalent Condition for Approximate Strategyproofness 

Recall that the definition of e-approximate strategyproofness imposes an upper bound 
on the gain that agents can obtain by misreporting. In particular, inequality (3) must 
hold for all utility functions that represent the agent’s preference order. Since there 
are infinitely many such utility functions, a naive approach to verifying e-approximate 
strategyproofness of a given mechanism would involve checking an infinite number of 
constraints. This is somewhat unattractive from an axiomatic perspective and even 
prohibitive from an algorithmic perspective. Fortunately, we can bypass this issue, as 
the next Theorem 1 shows. 

Theorem 1. Given a setting ( N,M ), a bound e e [0,1], and a mechanism p, the 
following are equivalent: 

1. p is e-approximately strategyproof in (. N,M ). 

2. For any agent i e N, any preference profile (Pi, P-f) e V N , any misreport P( e V, 
and any rank r e { 1 ,..., m), we have 

2 Fj( p i P-i) - <Pj(P» P-i) < £■ (5) 

jeM: rankp i (j)^r 


Proof Outline (formal proof in Appendix F.l). The key idea is to represent any utility 
function as an element of the convex hull of a certain set of extreme utility functions. 
For any combination (i,(P i: P-i), P(,k) the inequality in statement (2) is just the e- 
approximate strategyproofness constraints for one extreme utility function. □ 

Theorem 1 yields that ^-approximate strategyproofness can be equivalently expressed 
as a finite set of weak, linear inequalities. This has far-reaching consequences. In general, 
it unlocks approximate strategyproofness for use under the automated mechanism 
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design paradigm (Sandholm, 2003). Specifically, it enables our identification of optimal 
mechanisms as solutions to a particular linear program (Section 6). 

5. Desideratum Functions and Deficit 

While it is important to elicit truthful preferences, good incentives alone do not make a 
mechanism attractive. Instead, it should ultimately select desirable alternatives, where 
desirability depends on the agents’ preferences. In this section, we introduce a formal 
method to quantify the ability of mechanisms to achieve a given desideratum. 

5.1. Desideratum Functions 

To express a desideratum formally, we define desideratum functions. These reflect the 
value that society derives from selecting a particular alternative when the agents have a 
particular preference profile. 

Definition 4 (Desideratum Function). A desideratum function is a mapping d : M x V N —*■ [0,1], 
where d(j, P ) is the d-value associated with selecting alternative j when the agents have 
preferences P. 

We illustrate how desideratum functions represent desiderata with two examples. 

Example 1. Suppose that our goal is to select an alternative that is the first choice of 
as many agents as possible. We can define the corresponding desideratum function by 
setting d PLU (j, P) = n]/n, where nj is the number of agents whose first choice under P 
is j. Note that d PLU (j, P) is proportional to the Plurality score of j under P. 

Example 2. Alternatively, we can consider a binary desideratum. An alternative j is 
a Condorcet winner at P if it dominates all other alternatives in a pairwise majority 
comparison. A mechanism is Condorcet consistent if it selects Condorcet winners 
whenever they exist. We can reflect this desideratum by setting d CoN (j, P) = 1 for any j 
that is a Condorcet winner at P, and d CoN (j, P) = 0 otherwise. 

Desideratum functions are extended to (random) outcomes by taking expectations. 
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Definition 5 (Expected d-value). Given a desideratum function d. a preference profile 
P e V N , and an outcome x e A(M), the (expected) d-value of x at P is given by 



( 6 ) 


jeM 


The interpretation of d(x, P ) is straightforward: if d quantifies the value of alternatives 
(as in Example 1), then d(x, P ) is the expectation of the societal value from selecting an 
alternative according to x. If d reflects a binary desideratum (as in Example 2), then 
d(x, P ) is the probability of selecting an alternative with the desirable property. 

Remark 3. By taking expectations, the d-value of random outcomes is fully determined 
by the d-values of the alternatives. This linear structure is a key ingredient to our 
results. In Appendix E, we show that many (but not all) popular desiderata admit such 
a representation, and we also discuss the limitations. 

Ideally, mechanisms would always select outcomes that maximize the d-value. 

Definition 6 (d-maximizing). Given a desideratum function d and a preference profile 
P e V N , an outcome x e A(M) is d-maximizing at P if d(x,P ) = max jeM d(j. P). A 
mechanism ip is d-maximizing if, for any P e V N , <p(P) is d-maximizing at P. 

Note that for any preference profile P there always exists at least one alternative that 
is d-maximizing at P by construction. Furthermore, any d-maximizing random outcome 
must be a lottery over alternatives that are all d-maximizing at P. 

Example 1, continued. Recall the desideratum function d PLU (j,P) = nj/n, where 
n] is the number of agents who ranked j first under P. A mechanism is d PLU -maximizing 
if and only if it is a Plurality mechanism (i.e., a mechanism that selects only alternatives 
which are the first choice of a maximum number of agents). 

Example 2, continued. Recall that d CoN (j, P) = l{j Condorcet winners at p } expresses 
the desideratum to select Condorcet winners when they exist. Indeed, any d CoN - 
maximizing mechanism is Condorcet consistent. Moreover, at any preference profile P 
where no Condorcet winner exists, the minimal and maximal achievable d-values are 
both zero. At these P, the d CoN -maximizing mechanisms are therefore free to choose any 
outcome. Consequently, maximizing d CoN -value is equivalent to Condorcet consistency. 
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5.2. Deficit of Mechanisms 

Intuitively, the deficit of an outcome is the loss that society incurs from choosing that 
outcome instead of a d-maximizing outcome. 

Definition 7 (Deficit of Outcomes). Given a desideratum function d, a preference profile 
P e V N , and an outcome x e A (M), the d-deficit of x at P is 

S d (x,P) = max d(;j, P) - d(x,P ). (7) 

jeM 

Remark 4 (Relative Deficit). The difference in (7) is absolute ; however, in some situations, 
it may be more natural to consider relative differences, such as the ratio between the 
achieved and the maximal achievable d-value. As we show in Appendix A.l, it is without 
loss of generality that we restrict our attention to absolute differences. 

Equipped with the deficit of outcomes, we define the deficit of mechanisms. This 
measure is the “desideratum counterpart” to the measure e(f) for incentive properties. 

Definition 8 (Deficit of Mechanisms). Given a setting (. N,M ), a desideratum function 
d, and a mechanism tp, the (worst-case) d-deficit of f (in ( N , M)) is the highest d-deficit 
incurred by ip across all preference profiles; formally, 

Sr*(<p)=m*xSMP),P)- ( 8 ) 

Per N 

Intuitively, the deficit of the mechanism is determined by the most severe violation 
of the desideratum across all preference profiles. Thus, a mechanism with low deficit 
violates the desideratum only “a little bit” across all possible preference profiles. 

Remark 5. Another way to define the deficit of mechanisms arises when agents’ preference 
profiles are drawn from a known distribution. In Appendix A.2 we define this ex-ante 
deficit formally. All results in this paper hold for both notions of deficit. 

For the remainder of this paper, we fix an arbitrary setting ( N,M ), a desideratum 
expressed via a desideratum function d, and a notion of deficit 6 derived from d. The 
triple (N,M,5) is called a problem. Unless explicitly stated otherwise, our results are 
understood to hold for any fixed problem ( N , M, 6) separately. 
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Figure 2: Manipulability-deficit-plot with mechanism signatures: strategyproof (trian¬ 
gles), d-maximizing (circles), ideal (diamond), others (squares). 

6. Optimal Mechanisms 

We are now in a position to formalize and study optimal mechanisms, which are mecha¬ 
nisms that trade off manipulability and deficit optimally. 

6.1. Signatures of Mechanisms 

To compare different mechanisms, we introduce signatures. 

Definition 9 (Signature). Given a problem (N,M,5) and a mechanism the triple 
(e(<p),d(<p)) e [0,1] x [0,1] is called the signature of ip (in the problem (N, M, S)): 1 

Signatures allow a convenient graphical representation of the performance of any 
mechanism in terms of manipulability and deficit. Figure 2 gives examples of such 
signatures: since 0-approximate strategyproofness is equivalent to strategyproofness, 
the signature of any strategyproof mechanism have an e-component of 0. On the other 
hand, any d-maximizing mechanism have a signature with a d-component of 0. If an 
ideal mechanism exists, it has a signature in the origin (0,0). Mechanisms that are 
neither strategyproof nor d-maximizing have signatures in the half-open unit square 
(0,1] x (0,1]. 


4 Since we fix a problem (N,M,6), we refer to the tuple (e:(y),d(y)) simply as the signature of ip, 
keeping in mind that a mechanism’s signature may be different for different problems. 
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Figure 3: Example signatures of optimal mechanisms (filled circles) and non-optimal 
mechanisms (empty circles) at manipulability bounds £o,£i,£ 2 - 

6.2. Definition and Existence of Optimal Mechanisms 


When impossibility results prohibit the design of ideal mechanisms, the decision in 
favor of any mechanism necessarily involves a trade-off between manipulability and deficit. 
To make an informed decision about this trade-off, a mechanism designer must be aware 
of the different design options. One straightforward approach to this problem is to decide 
on a maximal acceptable manipulability £ e [0,1] up front and use a mechanism that 
minimizes the deficit among all ^approximately strategyproof mechanisms. We define 
6(e) = min{(5(</?) | ip ^approximately SP} to be the lowest deficit that is achievable by 
any ^approximately strategyproof mechanism. 

Definition 10 (Optimal Mechanism). Given a problem (N, M, 5) and a bound £ £ [0,1], 
a mechanism ip is optimal at e if ip is ^approximately strategyproof and S(ip) = 6(e). 
Denote by Opt(£) the set of all mechanisms that are optimal at e. Any optimal 
mechanism ip e Opt(£) is called a representative of Opt(e). 

Proposition 1 shows that optimal mechanisms always exist. 

Proposition 1. Given a problem (. N,M,6) and a manipulability bound e £ [0,1], there 
exists at least one mechanism that is optimal at e. 

Existence follows via a compactness argument (see Appendix F.2 for a proof). 
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Proposition 1 justifies the use of the minimum (rather than the infimum) in the defini¬ 
tion of 5(e), since the deficit 5(e) = 5 (ip) is in fact attained by some mechanism. Figure 
3 illustrates signatures of optimal and non-optimal mechanisms. On the vertical lines at 
each of the manipulability bounds e 0 = 0, ei,e 2 , the circles (empty circles) correspond to 
signatures of non-optimal mechanisms. The signatures of optimal mechanisms (filled 
circles) from OPT(efc), k = 0,1, 2 take the lowest positions on the vertical lines. 

6.3. Identifying Optimal Mechanisms 

The existence proof for optimal mechanisms is implicit and does not provide a way of 
actually determining them. Our next result establishes a correspondence between the 
set OPT(e) and the set of solutions to a linear program. We can solve this program 
algorithmically to find representatives of OPT(e) and to compute 5(e). 

Linear Program 1 (FindOpt). 


minimize 

d 

( Objective) 

subject to 

2 f j (P / i .P^i)-f j (P i ,P_i) 

jeM: r ankp^ (j)^k 

(e- approximate SP) 


Vi e N, (Pi, P-i) e V N , P[ e V, k e {1, ..., m } 



d ^ niax jeM d(j, P) - J) jeM f j ( p ) ' d (p P )i VP e pN 

(Deficit) 


2>(P) = 1, VPe? a 

jeM 

(Probability) 


fj (P) e [0,1], VPeV N ,jeM 

(Outcome variables) 


d 6 [0,1], 

(Deficit variable) 

Each variable fj(P) corresponds to the probability with which the mechanism selects 
alternative j if the agents report preference profile P. Consequently, any assignment of the 
variables (f j (P) : j e M, P e V N } corresponds to a unique mapping ip : M x V N —» R A/ . 
The two constraints labeled (Probability) and ( Outcome variables) ensure that the 
variable assignment in fact corresponds to a mechanism (rather than just a mapping 
from preference profiles to R A/ ). The additional variable d represents this mechanism’s 


deficit and the objective is to minimize its value. 
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The constraints labeled (e-approximate SP) reflect the equivalent condition for e- 
approximate strategyproofness that we obtained from Theorem 1. In combination, these 
constraints ensure that the mechanisms corresponding to the feasible variable assignments 
of FindOpt are exactly the ^-approximately strategyproof mechanisms. The constraint 
labeled (Deficit) makes d an upper bound for the deficit of ipf 

The following Proposition 2 formalizes the correspondence between optimal mechanisms 
and solutions of the linear program FindOpt. 

Proposition 2. Given a problem (IV, M, 5) and a bound ee [0,1], a variable assignment 
{f j(P) : j e M, P e V N } is a solution of FindOpt at e if and only if the mechanism tp 
defined by ipj(P) = f j(P) for all j e M, P e V N is optimal at e. 

The proof follows directly from the discussion above. One important consequence 
of Proposition 2 is that we can compute optimal mechanisms for any given problem 
(N,M,S) and any manipulability bound £ e [0,1]. Going back to the mechanism 
designer’s problem of trading off manipulability and deficit, we now have a way of 
determining optimal mechanisms for particular manipulability bounds e. With FindOpt 
we can evaluate algorithmically what deficit we must accept when manipulability must 
not exceed some fixed limit e. 

Shifting the burden of design to a computer by encoding good mechanisms in optimiza¬ 
tion problems is the central idea of automated mechanism design (Sandholm, 2003). A 
common challenge with this approach is that the optimization problem can become large 
and difficult to solve; and naive implementations of FindOpt will face this issue as well. 
Substantial run-time improvements are possible, e.g., by exploiting additional axioms 
such as anonymity and neutrality (Mennle, Abaecherli and Seuken, 2015). Nonetheless, 
determining optimal mechanisms remains a computationally expensive operation. 

Computational considerations aside, Proposition 2 provides a new understanding of 
optimal mechanisms: since OPT(k) corresponds to the solutions of the linear program 
FindOpt, it- can be interpreted as a convex polytope. In Section 8 we use methods 
from convex geometry to derive our structural characterization of the Pareto frontier. 
The representation of optimal mechanisms as solutions to FindOpt constitutes the first 
building block of this characterization. 

5 Alternatively, we can implement the ex-ante deficit by replacing the (Deficit )-constraint (see Appendix 

A. 2). 
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7. Hybrid Mechanisms 


In this section, we introduce hybrid mechanisms, which are convex combinations of two 
component mechanisms. Intuitively, by mixing one mechanism with low manipulability 
and another mechanism with low deficit, we may hope to obtain new mechanisms with 
intermediate signatures. Initially, the construction of hybrids is independent of the study 
of optimal mechanisms. However, in Section 8, they will constitute the second building 
block for our structural characterization of the Pareto frontier. 

Definition 11 (Hybrid). For (3 e [0,1] and mechanisms p and i/j, the (3-hybrid hp is 
given by hp(P) = (1 — (3)p(P) + f3ip{P) for any preference profile P e V N . 

In practice, “running” a hybrid mechanism is straightforward: first, collect the prefer¬ 
ence reports. Second, toss a /3-coin to determine whether to use if} (probability (3) or p 
(probability 1 — /3). Third, apply this mechanism to the reported preference profile. Our 
next result formalizes the intuition that hybrids have at least intermediate signatures. 

Theorem 2. Given a problem (. N,M,S ), mechanisms p,if, and (3 e [0,1], we have 

e(hp) (1-/3 )e(p) + f3e(^), (9) 

S(hp) < (l-/3)%)+/3^). (10) 

Proof Outline (formal proof in Appendix F.3). We write out the definitions of e(hp) and 
S(hp), each of which may involve taking a maximum. The two inequalities are then 
obtained with the help of the triangle inequality. □ 

In words, the signatures of /3-hybrids are always weakly better than the /3-convex 
combination of the signatures of the two component mechanisms. 

There are two important takeaways from Theorem 2. First, it yields a strong argument 
in favor of randomization: given two mechanisms with attractive manipulability and 
deficit, randomizing between the two always yields a mechanism with a signature that is 
at least as attractive as the /3-convex combination of the signatures of the two mechanisms. 
As Example 3 in Appendix B shows, randomizing in this way can yield strictly preferable 
mechanisms that have strictly lower manipulability and strictly lower deficit than either 
of the component mechanisms. 
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The second takeaway is that the common fairness requirement of anonymity comes “for 
free” in terms of manipulability and deficit (provided that the deficit measure 5 is itself 
anonymous): given any mechanism p, an anonymous mechanism can be constructed by 
randomly assigning the agents to new roles. This yields a hybrid mechanism with many 
components, each of which corresponds to the original mechanism with agents assigned 
to different roles. Under an anonymous deficit notion, every component will have the 
same signature as <p. If follows from Theorem 2 that this new anonymous mechanism has 
a weakly better signature than p. Similarly, we can impose neutrality without having to 
accept higher manipulability or more deficit (if 6 is itself neutral). We formalize these 
insights in Appendix C. 

8. The Pareto Frontier 

Recall that optimal mechanisms are those mechanisms that trade off manipulability and 
deficit optimally. They form the Pareto frontier because we cannot achieve a strictly 
lower deficit without accepting strictly higher manipulability. 

Definition 12 (Pareto Frontier). Given a problem (N,M,5), let E be the smallest 
manipulability bound that is compatible with d- in axi in i z at ion; formally, 

E = min{e e [0,1] | 3p : p d-maxiinizing & ^-approximately SP}. (11) 

The Pareto frontier is the union of all mechanisms that are optimal for some manipula¬ 
bility bound £ e [0, A]; formally, 


P F = U Opt(s) . (12) 

£E [0 ,£■] 

The special manipulability bound E is chosen such that maximal d-value can be 
achieved with an ^-approximately strategyproof mechanisms (p, say) but not with any 
mechanism that has strictly lower manipulability. Since (p has deficit 0, any mechanism 
p that is optimal at some larger manipulability bound e > E may be more manipulable 
than p but ip cannot have a strictly lower deficit. Thus, we can restrict attention to 
manipulability bounds between 0 and E (instead of 0 and 1). From the perspective of 
the mechanism designer, mechanisms on the Pareto frontier are the only mechanisms 
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that should be considered; if a mechanism is not on the Pareto frontier, we can find 
another mechanism that is a Pareto-improvement in the sense that it has strictly lower 
manipulability, strictly lower deficit, or both. 

8.1. Monotonicity and Convexity 

Recall that we have defined 5(e) as the smallest deficit that can be attained by any 
^-approximately strategyproof mechanism. Thus, the signatures of mechanisms on the 
Pareto frontier are described by the mapping e >—>■ 5(e) that associates each manipulability 
bound e e [0,e] with the deficit 5(e) of optimal mechanisms at this manipulability bound. 
Based on our results so far, we can already make interesting observations about the 
Pareto frontier by analyzing this mapping. 

Corollary 1. Given a problem (N,M,5), the mapping e *-» 5(e) is monotonically 
decreasing and convex. 

Monotonicity follows from the definition of optimal mechanisms, and convexity is a 
consequence of Theorem 2 (see Appendix F.4 for a formal proof). While monotonicity 
is merely reassuring, convexity is non-trivial and very important. It means that when 
we relax strategyproofness, the first unit of manipulability that we give up allows the 
largest reduction of deficit. For any additional unit of manipulability that we sacrifice, 
the deficit will be reduced at a lower rate, which means decreasing marginal returns. 
Thus, we can expect to capture most gains in d-value from relaxing strategyproofness 
early on. Moreover, convexity and monotonicity together imply continuity. This means 
that trade-offs along the Pareto frontier are smooth in the sense that a tiny reduction of 
the manipulability bound e does not require accepting a vastly higher deficit. 

For mechanism designers, these observations deliver an important lesson: the most 
substantial gains (per unit of manipulability) arise from relaxing strategyproofness just 
“a little bit.” This provides encouragement to investigate the gains from accepting even 
small amounts of manipulability. On the other hand, if the initial gains are not worth 
the sacrifice, then gains from accepting more manipulability will not be “surprisingly” 
attractive either. 
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8.2. A Structural Characterization of the Pareto Frontier 

In Section 6, we have shown that we can identify optimal mechanisms for individual 
manipulability bounds by solving the linear program FindOpt. In Section 7, we have 
introduced hybrids, and we have shown how mixing two mechanisms results in new 
mechanisms with intermediate or even superior signatures. We now give our main result, 
a structural characterization of the Pareto frontier in terms of these two building blocks, 
namely optimal mechanisms and hybrids. 

Theorem 3. Given a problem (N,M,S), there exists a finite set of supporting manipu¬ 
lability bounds 

Eq = 0 < £\ < . . . < £k~ 1 &K = ( 13 ) 

such that for any k e {1,..., K) and any e e \e k _ i, £ fc ] with /3 = we have that 

OPT(£) = (1 - ^)OPT(£ fc _i) + /3C>PT(£ fc ), (14) 

5(e) = (1 - p)6(e k -i) +/35(e k ). (15) 

Proof Outline (formal proof in Appendix F. 5). Our proof exploits that OPT(e) corre¬ 
sponds to the solutions of the linear program FindOpt (Section 6.3) with feasible set 
F e = {x |Dx ^ d, Ax ^ e}, where neither D, nor d, nor A depend on e. First, we show 
that if a set of constraints is binding for F £ , then it is binding for F e > for e! within a 
compact interval [£ _ ,£ + ] that contains e and not binding for any e" f [e _ ,e + ]. With 
finiteness of the number of constraints of the LP, this yields a finite segmentation of 
[0,k]. The vertex-representations (Griinbaum, 2003) can then be used to show that 
on each segment [£*,_!,£*,], the solution sets S E = argraind are exactly the /3-convex 
combinations of S E . , and S Eu with B = £ ~ £k ~ 1 , □ 

It would be particularly simple if the optimal mechanisms at some manipulability 
bound £ were just the /3-hybrids of optimal mechanisms at 0 and e with (3 = e/e. While 
this is not true in general, Theorem 3 shows that the Pareto frontier has a linear structure 
over each interval \£ k -i,£k\- Thus, it is completely identified by two building blocks: (1) 
the sets of optimal mechanisms OPT(£ fc ) for finitely many e k , k = 0, ..., K, and (2) hybrid 
mechanisms , which provide the missing link for £ ^ £ k . Representatives of OPT(£fc) can 
be obtained by solving the linear program FindOpt at the supporting manipulability 
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Figure 4: Illustrative example of the signatures of the Pareto frontier. 

bounds ; and for intermediate bounds e = [\ — (d)Ek -1 + f3 £ k, a mechanism <p is 
optimal at e if and only if it is a /3-hybrid of two mechanisms (pk-i e Opt(£a,_i) and 
ifk e Opt (£k)- 

Theorem 3 allows an additional insight about the mapping e <—> 6(e) (where 6(e) = 
min{(5(cp) | (p ^approximately SP}). We have already observed that this mapping is 
monotonic, decreasing, convex, and continuous (see Corollary 1). In addition, we obtain 
piecewise linearity. 

Corollary 2. Given a problem (N,M,6), e >->■ 6(e) is piecewise linear. 

Figure 4 illustrates the results of Theorem 3 and Corollary 2: first, the mapping 
£ 6(e) is monotonic, decreasing, convex, continuous, and piecewise linear, and, second, 

optimal mechanisms with intermediate manipulability can be obtained by mixing two 
mechanisms that are optimal at the two adjacent supporting manipulability bounds, 
respectively. 

9. Computing the Pareto Frontier: Algorithms and 
Examples 

In this section we discuss an algorithm that exploits the structural characterization from 
Theorem 3 to compute all supporting manipulability bounds. Then we derive the Pareto 
frontier for two example problems. 
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9.1. Algorithm FindBounds 


Recall that the linear program FindOpt can be used to determine a representative of the 
set of optimal mechanisms OPT(e). One naive approach to identifying the Pareto frontier 
would be to run FindOpt for many different manipulability bounds to obtain optimal 
mechanisms at each of these bounds, and then consider these mechanisms and their 
hybrids. However, this method has two drawbacks: first, and most importantly, it would 
not yield the correct Pareto frontier. The result can, at best, be viewed as a conservative 
estimate , since choosing fixed manipulability bounds is not guaranteed to identify 
any actual supporting manipulability bounds exactly. Second, from a computational 
perspective, executing FindOpt is expensive, which is why we would like to keep the 
number of executions as low as possible. 

Knowing the structure of the Pareto frontier, we can use the information obtained 
from iterated applications of FindOpt to interpolate the most promising candidates 
for supporting manipulability bounds. In Appendix D we provide the algorithms 
FindBounds (Algorithm 1) and FindLower (Algorithm 2) that do this. Proposition 
3 summarizes their properties. 

Proposition 3. Given a problem (. N,M,S ), the algorithms FindLower and Find¬ 
Bounds require at most 4 K + log 2 (l/£i) — 1 executions of the linear program FindOpt 
to determine all supporting manipulability bounds of the Pareto frontier, where K is the 
number of supporting manipulability bounds and e ± is the smallest non-trivial supporting 
manipulability bound. 

Due to space constraints we delegate the detailed discussion of the algorithms and the 
proof of Proposition 3 to Appendix D. 

9.2. Examples: Plurality Scoring and Veto Scoring 

In this section, we consider two concrete problems and derive the respective Pareto 
frontiers. The two examples highlight the different shapes that the Pareto frontier can 
take. Both settings contain 3 alternatives and 3 agents with strict preferences over the 
alternatives, but they differ in the desideratum. 
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Plurality and Random Dictatorships Consider a setting with agents N = {1,2,3}, 
alternatives M = {a, b , c}, and where agents’ preferences are strict. Suppose further 
that the desideratum is to select alternatives that are the first choice of as many agents 
as possible. From Example 1 we know that the corresponding desideratum function is 
d FhV (j,P) = n]/n, where is the number of agents whose first choice under P is j. 
Finally, suppose that the deficit <5 Plu is the worst-case d PLU -dcficit; formally, 



(16) 


Using FiNDBoUNDS, we find that in this problem, the Pareto frontier has only two 
supporting manipulability bounds £ 0 = 0 and e = £\ = 1/3. Thus, it consists precisely 
of the hybrids of mechanisms that are optimal at £o an d £i by Theorem 3. Moreover, 
we can use FindOpt to obtain representatives of Opt(O) and Opt(1/3). Interestingly, 
the representatives determined by the algorithm have a familiar structure: first, the 
representative of Opt(O) corresponds to Random Dictatorship with a uniform choice 
of the dictator. Thus, in this problem, no strategyproof mechanism has lower deficit 
than Random Dictatorship. Second, the representative of Opt(1/3) corresponds to 
Uniform Plurality , a mechanism that determines the set of d PLU -maximizing alternatives 
and selects one of these uniformly at random. Thus, in this problem, no d-maximizing 
mechanism has lower manipulability than Uniform Plurality. Figure 5 (a) depicts the 
signatures of the Pareto frontier. 

In addition, we prove these insights analytically. 

Proposition 4. In a problem (N , M, d PLU ) with n = 3 agents, m = 3 alternatives, strict 
preferences, and where d PLU is the worst-case d PLU -deficit, the following hold: 

1. The Pareto frontier has two supporting manipulability bounds 0 and 1/3. 

2. Random Dictatorship is a representative of Opt(O). 

3. Uniform Plurality is a representative o/Opt(1/3). 

The formal proof is given in Appendix F.6. 

Veto and Random Duple The second problem again involves a setting with three 
agents, three alternatives, and agents’ preferences are strict. The difference to the previous 
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Figure 5: Plot of signatures of the Pareto frontier for n = 3 agents, m = 3 alternatives, 
strict preferences, (a) worst-case d PLU -deficit <5 Plu and (b) worst-case d V ETO- 
deficit h VET °. 

problem is the different desideratum: this time, our goal is to select an alternative that 
is the last choice of as few agents as possible. This desideratum is reflected by the 
desideratum function d VET0 (j, P) = (n — nf)/n, where rif 1 is the number of agents whose 
last choice under P was j. The worst-case d VETO -dcficit h VET0 is given by 

■5 V,T » - max (max (rf v ™(j, P)) - d VET >(P), P)) . (17) 

Again, we use the algorithm FindBounds to determine the supporting manipulability 
bounds of the Pareto frontier in this problem. These are £q = 0,£i = 1 / 21,62 = 1/12, e = 
63 = 1 / 2 . As in the previous example, we can compute representatives of the optimal 
mechanisms at each of these bounds. For the extreme bounds £q = 0 and e = 1/2, 
these representatives again have a familiar structure: first, the representative of Opt(O) 
corresponds to Random Duple, a mechanism that picks two alternatives uniformly at 
random and then selects the one that is preferred to the other by a majority of the 
agents (breaking ties randomly). Second, the representative of Opt(1/2) corresponds 
to Uniform Veto, a mechanism that finds all alternatives that are the last choice of a 
minimal number of agents and selects one of these alternatives uniformly at random. 
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Figure 5 (b) depicts the signatures of the Pareto frontier in this problem. 

We also created representatives of Opt(1/21) and Opt(1/12) via FindOpt (they are 
given in Appendix F.7 in their numerical form). While the interpretation of these two 
mechanisms is not straightforward, it is clear that neither of them is a hybrid Random 
Duple and Uniform Veto. Indeed, in order to generate mechanisms on the Pareto frontier 
in this problem, we cannot simply consider hybrids of optimal mechanisms from the 
extreme supporting manipulability bounds. Instead, we can (and have to) exploit the 
additional design freedom in the particular problem by separately designing optimal 
mechanisms for the two intermediate supporting manipulability bounds ey = 1/21 and 
e 2 = 1/12 specifically. 

As in the previous example, we convince ourselves of the correctness of these assertions 
by proving them analytically. 

Proposition 5. In a problem (A/M, 5 Vet0 ) with n = 3 agents, m = 3 alternatives, 
strict preferences, and where <5 Vet0 is the worst-case d Veto -deficit, the following hold: 

1. The Pareto frontier has four supporting manipulability bounds 0, 1/21, 1/12, 1/2. 

2. Random Duple is a representative of Opt(O). 

3. Uniform Veto is a representative of Opt(1/2). 

4 . Hybrids of Random Duple and Uniform Veto not optimal for f3 e (0,1/2). 

The formal proof is given in Appendix F.7. 

Remark 6. The fact that we obtain Random Dictatorship and Random Duple as the 
optimal strategyproof mechanisms in the two problems, respectively, highlights a connec¬ 
tion between our results and the characterization of strategyproof random mechanisms 
by Gibbard (1977). We discuss this connection in Appendix C and we present a new 
symmetric decomposition result that may be of independent interest. 

Pareto Frontiers in Larger Settings For larger settings analytic insights about the 
Pareto frontier are presently not available. However, we can apply the algorithm 
FindBounds to identify the Pareto frontier algorithmically. 6 Figure 6 shows signatures 
of Pareto frontiers for m = 3 alternatives, up to n = 18 agents, and the worst-case 
d PLU -deficit (a) and d VETO -deficit (b), respectively. 

6 This can be achieved by solving reduced linear programs, see (Mennle, Abaecherli and Seuken, 2015). 
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Figure 6: Plots of signatures of the Pareto frontier for n e {6, 9,12,15,18} agents, m = 3 
alternatives, strict preferences, and worst-case rf PLU -deficit (left) and worst-case 
rfVETO-deficit (right). 

The plots suggest that the Pareto frontier converges to an L-shape as the number of 
agents grows. Based on this observation, we conjecture that for these two desiderata 
near-ideal mechanisms can be found in large markets. If true, we could find mechanisms 
that are almost strategyproof and almost achieve the desideratum perfectly. Proving 
these limit results will be an interesting topic for future research. 


10. Conclusion 

In this paper, we have presented a structural characterization of the Pareto frontier for 
random ordinal mechanisms. Loosely speaking, the Pareto frontier consists of those 
mechanisms that make optimal trade-offs between incentive properties (measured by 
manipulability e((p)) and other desiderata (measured by deficit <5(<p))), such as Condorcet 
consistency or the goal of choosing an alternative that is the first choice of as many 
agents as possible. 

We have achieved our main result in three distinct steps: first, we have shown that 
e-approximate strategyproofness can be equivalently expressed by a finite set of linear 
constraints. This has enabled us to define the linear program FindOpt to identify the set 
of all mechanisms that have minimal deficit but satisfy e-approximate strategyproofness 
for a given manipulability bound e. Second, we have shown how hybrid mechanisms, 
which are convex combinations of two component mechanisms, trade off manipulability 




and deficit. In particular, we have given a guarantee that the signature of a /3-hybrid 
hp is always at least as good as the /3-convex combination of the signatures of the two 
component mechanisms. Third, we have shown that the Pareto frontier consists of 
two building blocks: (f) there exists a finite set of supporting manipulability bounds 
£q,,£r such that we can characterize the set of optimal mechanisms at each of the 
bounds £k as the set of solutions to the linear program FindOpt at £&, and (2) for any 
intermediate manipulability bound e = (1 — fd)£k-i + 0£k, the set of optimal mechanisms 
at £ is precisely the set of /3-hybrids of optimal mechanisms at each of the two adjacent 
supporting manipulability bounds £k-i and £*,. 

Our results have a number of interesting consequences (beyond their relevance in this 
paper): first, Theorem f gives a finite set of linear constraints that is equivalent to 
^-approximate strategyproofness. This makes e-approxiinate strategyproofness accessible 
to algorithmic analysis. In particular, it enables the use of this incentive requirement 
under the automated mechanism design paradigm. 

Second, the performance guarantees for hybrid mechanisms from Theorem 2 yield 
convincing arguments in favor of randomization. In particular, we learn that the 
important requirements of anonymity and neutrality come “for free;” mechanism designers 
do not have to accept a less desirable signature when imposing either or both (provided 
that the deficit measure is anonymous, neutral, or both). 

Third, our main result, Theorem 3, has provided a structural understanding of the 
whole Pareto frontier. Knowledge of the Pareto frontier enables mechanism designers 
to make a completely informed decision about trade-offs between manipulability and 
deficit. In particular, we now have a way to determine precisely by how much the 
performance of mechanisms (with respect to a given desideratum) can be improved when 
allowing additional manipulability. An important learning is that the mapping £ i—> 6 (e), 
which associates each manipulability bound with the lowest achievable deficit at this 
manipulability bound, is monotonic , decreasing , convex , continuous , and piecewise linear. 
This means that when trading off manipulability and deficit along the Pareto frontier, 
the trade-offs are smooth, and the earliest sacrifices yield the greatest gains. Thus, it 
can be worthwhile to consider even small bounds £ > 0 in order to obtain substantial 
improvements. 

Finally, we have illustrated our results by considering two concrete problems. In 
both problems, three agents had strict preferences over three alternatives. In the first 
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problem, the desideratum was to choose an alternative that is the first choice of as many 
agents as possible (i.e., Plurality scoring), and in the second problem, the desideratum 
was to choose an alternative that is the last choice of as few agents as possible (i.e., 
Veto scoring). In both problems, we have computed the Pareto frontier and verified 
the resulting structure analytically. The examples have shown that the Pareto frontier 
may be completely linear (first problem) or truly non-linear (second problem). For 
the same desiderata and up to n = 18 agents we have determined the Pareto frontier 
algorithmically and formulated a conjecture about its limit behavior. 

In summary, we have given novel insights about the Pareto frontier for random ordinal 
mechanisms. We have proven our results for the full ordinal domain that includes 
indifferences, but they continue to hold for many other interesting domains that arise by 
restricting the space of preference profiles, such as the assignment domain and the two- 
sided matching domain. When impossibility results restrict the design of strategyproof 
mechanisms, we have provided a new perspective on the unavoidable trade-off between 
incentives and other desiderata along this Pareto frontier. 
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APPENDIX 


A. Relative and Ex-ante Deficit 

We have defined the deficit of outcomes (Definition 7) as the absolute difference between 
the achievable and the achieved cl-value; and we have defined the deficit of mechanisms 
(Definition 8 ) as the worst-case deficit across all possible preference profiles. In this 
section we present two variations of these definitions, the relative deficit of outcomes 
and the ex-ante deficit of mechanisms. Our results in this paper hold for any of these 
variations. 


A.l. Relative Deficit of Outcomes 


In some situations, it may be more natural to consider a relative difference, e.g., the 
ratio between the achieved and the maximal achievable d-value. As we show next, 
it is without loss of generality that in this paper we have restricted our attention to 
absolute differences. This is because the relative d-deficit can always be expressed as 
an absolute d-deficit, where the adjusted desideratum function d is obtained from d by 
scaling. Proposition 6 makes this argument precise. 

To state this equivalence formally, we need to define the relative deficit: for any 
preference profile P e V N , the d-value margin at P is the difference between the 
highest and the lowest d-value achievable by any alternative at P. We set d max (P) = 
ma Xj eM d(j, P), d min (P) = min d(j, P), and d margm (P) = d max (P) — d mm (P). Note 
that for the special case where d margin (P) = 0, all alternatives (and therefore all outcomes) 
have the same d-value. In this case, any alternative is d-maximizing at P. For an outcome 
x 6 A(M), the relative d-deficit of x at P is the d-dcficit of x at P, normalized by the 
d-value margin at P; formally, 


^relative 

°d 


(x,P) 


d m ^{P)-d(x,P) 

^margin ( p) ) 


0, 


if d margin (P) > 0, 
else. 


(18) 


Proposition 6. For any desideratum function d, there exists a desideratum function 
d such that the relative d-deficit coincides with the absolute d-deficit, such that for all 
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outcomes x e A (M) and all preference profiles P e V N , we have 

5Z lat ™(x,P) = 5 d (x,P). (19) 

The proof follows immediately by setting d( j, P) = d jpy -*- , whenever <j margin (P) > 

0, and d(j , P ) = 0 otherwise. Proposition 6 shows that including relative deficit does 
not enrich the space of possible criteria but that the space of desideratum functions is 
rich enough to cover relative deficits implicitly. Thus, it is without loss of generality that 
we have restricted attention to absolute deficits in this paper. 

A.2. Ex-ante Deficit of Mechanisms 

Recall that we defined the deficit of mechanisms as the worst-case loss that society incurs 
from using a mechanism that is not d-maximizing. This is most meaningful when we have 
no prior knowledge of the agents’ preferences and therefore need to design mechanisms 
that achieve the desideratum as well as possible across all possible preference profiles. 

However, in some situations, we may have probabilistic information about the agents’ 
preferences, which we would like to exploit to design better mechanisms. Suppose that 
the agents’ preference profiles are drawn from a known distribution P. In this case, we 
may prefer a mechanism that induces high expected d- value under P. 

Definition 13 (Ex-ante Deficit). Given a setting ( N,M ), a desideratum function d, 
a probability distribution P over preference profiles, and a mechanism <p, the ex-ante 
d-deficit of ip with respect to P (in ( N,M)) is 

#(*>)= 2 p[p]-«v(nn ( 20 ) 

PeV N 

Minimizing (ip) corresponds to minimizing the expected d-deficit from applying ip 
ex-ante (i.e., before the agents’ preferences are instantiated from P). This approach is 
attractive in situations where the same mechanism is applied repeatedly for different 
groups of agents, so that the outcomes are attractive on average across all the repetitions. 

We can incorporate the ex-ante deficit into the linear program FindOpt (Linear 
Program 1) by exchanging the constraint labeled (Deficit). Instead of making the variable 
d an upper bound for the deficit of the mechanism across all preference profiles, we 
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need to make d an upper bound for the expected deficit of the mechanism, where this 
expectation is taken with respect to the distribution P over preference profiles. We 
achieve this by including the following constraint. 


2 P[P]- 

PeV N 


( max 

jeM 


jeM ) 


(. Ex-ante deficit ) 


B. Strict Improvements from Hybrids in Theorem 2 

Theorem 2 showed two weak inequalities for hybrid mechanisms. We now give an 
example that shows that a hybrid of two mechanisms can in fact have a strictly lower 
manipulability and a strictly lower deficit than both of its component mechanisms. 

Example 3. Consider a problem with one agent and three alternatives a, b , c, where 6 is 
the worst-case deficit that arises from Plurality scoring. Let ip and if be two mechanisms 
whose outcomes depend only on the agent’s relative ranking of b and c. 




if 

Report 

a 

b 

c 

a 

b 

c 

If P : b > c 

0 

2/3 

1/3 

5/9 

1/9 

1/3 

HP: c>b 

1/3 

1/3 

1/3 

1/9 

5/9 

1/3 


It is a simple exercise to verify that the mechanisms’ signatures are (s(ip), 5(<p)) = (1/3,1) 
and (e( , 0), 6 (if)) = (4/9, 8/9). Furthermore, for /3 = 3/7, the hybrid hp is constant and 
therefore strategyproof, and it has a deficit of S(hp) = 16/21. Figure 7 illustrates these 
signatures. The guarantees from Theorem 2 are represented by the shaded area, where 
the signature of hp can lie anywhere below and to the left of the /3-convex combination 
of the signatures of and if. 


C. Anonymity, Neutrality, Symmetric Decomposition 

Two common requirements in the design of ordinal mechanisms are anonymity and 
neutrality. Anonymity captures the intuition that a mechanism should not discriminate 
between agents; instead, the influence of any agent on the outcome should be the same 
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Deficit 5 


H_ A 

p 

No 0 

•- 

1 


Manipulability 


Figure 7: Example signature of hybrid hp (•) must lie in the shaded area, weakly to the 
left and below the /3-convex combinations of the signatures of p and -0 (°)- 


and independent of the agent’s name. Neutrality requires that the mechanism is not 
biased towards particular alternatives; the decision should depend only on the agents’ 
preferences but not on the names of the alternatives. 

In this section we describe the implications of these two requirements for the design of 
optimal mechanisms: after providing definitions, we show how they can be incorporated in 
the linear program FindOpt. Then we formally prove the second takeaway from Theorem 
2 that (under certain conditions) both requirements come for free in terms of the signatures 
of optimal mechanisms. Finally, we prove a new symmetric decomposition result for 
strategyproof, anonymous, neutral mechanisms, that extends the characterization of 
strategyproof random mechanisms in (Gibbard, 1977). 


C.l. Definition of Anonymity and Neutrality 

First, we define anonymity: for any renaming of the agents (i.e., any bijection tt : N —» N) 
and any preference profile P = (Pi,..., P n ) e V N , let P n = (P n (i), ■ ■ ■, Pn(n)) be the 
preference profile where the agents have exchanged their roles according to n. Agent % 
is now reporting the preference order P^m that was reported by agent tt( i) under the 
original preference profile P. For any mechanism p let p n be the mechanism under which 
the agents trade roles according to 7r; formally, let pP(P) = p(P w ) for any preference 
profile P e V N . 
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Definition 14 (Anonymity). • A desideratum function d is anonymous if for all 
renamings n : N —> N, preference profiles P e V N , and alternatives j e M, we 
have d(j, P ) = d(j, P n ) (i.e., the d-value is independent of the order in which the 
agents submit their preferences). 

• A probability distribution P over preference profiles is anonymous if for all renam¬ 
ings tt : N N and preference profiles P e V N , we have P[P] = PfP 71 ^ (i.e., 
the probability of a preference profile does not depend on the order in which the 
different preference orders appear). 

• The worst-case deficit 5d is anonymous if the underlying desideratum function d is 
anonymous. The ex-ante deficit hj is anonymous if the underlying desideratum 
function and the probability distribution P are anonymous. 

• A mechanism p is anonymous if for all renamings n : N —> N and preference 
profiles P e V N , we have p(P) = (p n (P) (i.e., the outcome of the mechanism is 
independent of the order in which the agents submit their preferences). 

Next, we define neutrality: for any renaming of the alternatives (i.e., any biject.ion 
vo : M —> M) and any preference order Pi e V, let Pf 7 be the preference order under 
which Pf 7 : w (j ) > vo(j') whenever Pi', j > j' for any alternatives j, jf e M. This means 
that Pf 7 corresponds to P t , except that the all alternatives have been renamed according 
to vo. For any preference profile P = (Pi,..., P n ) e V N , let P ro = (Pf 7 , ..., Pff) be the 
preference profile where the alternatives inside the agents’ preference orders have been 
renamed according to w. For any mechanism ip let pf 7 be the mechanism under which 
the alternatives are renamed according to w\ formally, let <pJ(P) = (p^^{P m ) for all 
preference profile P e V N and alternative j e M. 

Definition 15 (Neutrality). We define the following: 

• A desideratum function d is neutral if for all renamings vo : M -+ M, preference 
profiles P e V N , and alternatives j e M, we have d(j,P) = d(w(j),P ro ) (i.e., the 
d -value of any alternative is independent of its name). 

• A probability distribution P over preference profiles is neutral if for all renamings 
vo : M —> M and preference profiles P e V N , we have P[P] = P[P ro ] (i.e., the 
probability of a preference profile does not depend on the names of the alternatives). 
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• The worst-case deficit 8 ( i is neutral if the underlying desideratum function cl is 
neutral. The ex-ante deficit 5^ is neutral if the underlying desideratum function 
and the probability distribution P are neutral. 

• A mechanism ip is neutral if for all renamings w : M —> M, preference profiles 
P e V N , and alternatives j e M, we have ipj(P) = <pJ{P) = (P ro ) (i.e., the 
outcomes of the mechanism are independent of the names of the alternatives). 

Incorporating anonymity and neutrality as additional constraints in the linear program 
FindOpt is straightforward and can be done as follows. 

Linear Program f (FindOpt), extended. 

fj(P) = fj(P 7r ), VP e V N ,j £ M, 7T : N —» N bijection (Anonymity) 

fj(P) = f ro (j)(P ro ), VP £ V N ,j e M,m : M —> M bijection (Neutrality) 


C.2. Costlessness of Requiring Anonymity and Neutrality 

With these notions of anonymity and neutrality in mind, observe that for any given 
mechanism it is possible to construct an anonymous mechanism or a neutral mechanism 
by randomizing over the roles of the agents or the roles of the alternatives in the 
mechanism, respectively: let 

*T° n ( p ) = (i E V](P) (21) 

7T : N -► N 
bijection 

and 

■prw E ^(p) (22) 

vj : M ^ M 
bijection 

for all preference profiles P £ V N and alternatives j £ M. Observe that <^ anon and <^ neut 
are simply hybrid mechanisms with many components, where each component is used 
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with a probability of ^ or Ay, respectively. With these definitions we can formally derive 
the second main takeaway from Theorem 2. 

Corollary 3. Given a problem ( N,M,S), where the deficit is anonymous/neutral/both, 
for any mechanism p there exists a mechanism p that is anonymous/neutral/both and 
has a weakly better signature than p; formally, e(p) ^ e(p) and 5(ip) ^ 5(p) 

Proof. Observe that if the deficit 6 is anonymous, then p and p 77 have the same signature 
for any renaming of the agents tt : N —> N. Consequently, ip anon is a hybrid of n\ 
mechanisms which all have the same signature, and therefore it has a weakly better 
signature by Theorem 2. Similarly, if 5 is neutral, then p and p w have the same signature 
for any renaming of the alternatives w : M —» M , and the result follows analogously. □ 

Intuitively, Corollary 3 means that, given the right desideratum, the two requirements 
anonymity and neutrality are “free” in terms of manipulability and deficit. We do not 
have to accept a less attractive signatures in order to achieve either property. 

C.3. Non-trivial Signature Cost of Other Desiderata 

In contrast to anonymity and neutrality, other common desiderata do not come for free, 
such as Condorcet consistency, Pareto optimality, or even the rather weak requirement 
of unanimity. 

Definition 16 (Unanimity, Pareto Optimality, Condorcet Consistency). For a given 
preference profile P e V N , define the following: 

• An alternative j e M is a unanimity winner at P if for all agents i e N and all 
other alternatives j' e M we have P* : j > j'. Let M unan (P) be the set of all 
unanimity winners at P and ibP unan (_P) = M\M unan (P) the set of non-winners. 

• An alternative j e M Pareto dominates another alternative j 1 e Mat P if for 
all agents i e N we have Pj : j > j 1 and for some agent i! we have P,/ : j > 
f. j is Pareto optimal at P if there exists no other alternative j 1 that Pareto 
dominates j. Let M Pareto (P) be the set of Pareto optimal alternatives at P, and let 
M -■ Pareto (p) = M\M Pareto (P) be the set of alternatives that are Pareto dominated 
by another alternative at P. 


39 


• For any two alternatives a,b s M let n a> b(P) = #{i s N | Pj : a > b} be the 
number of agents who strictly prefer a to b at P. An alternative j e M is a Condorcet 
winner at P if for all other alternatives j' e M we have Uj > j'{P ) ^ Ujr > j(P). 
j^Condorcetj g se ^ Q f Condorcet winners at P, and the set of non-Condorcet 
winners is M^ Condorcet (P) = M\M Condorcet (P). 

A mechanism ip satisfies unanimity, Pareto optimality, or Condorcet consistency, if 
it only selects alternatives that have the respective property whenever they exist. One 
way to incorporate these desiderata into the linear program Find Opt is to include them 
in the objective function by using a desideratum function that assigns higher value to 
alternatives that have the respective property. 

However, this is not sufficient if the optimal mechanisms must satisfy the requirement 
completely , independent of the resulting increase in manipulability. For example, the goal 
could be to find a unanimous, strategyproof mechanism that minimizes the worst-case 
deficit based on Veto scoring. In this case, it would not suffice to include unanimity in 
the desideratum function, because the only way to then guarantee unanimity would be 
to impose full value maximization. Alternatively, we can incorporate the property as 
additional constraints in the linear program FindOpt directly. The following linear con¬ 
straints can be used to require unanimity, Pareto optimality, and Condorcet consistency, 
respectively. 

Linear Program 1 (FindOpt), extended. 


fj(P) = 0, 

VP e V N such that M unan (P) A 0 and j £ ibP unan (P) 
fj(P) = 0, 

VP e V N ,j 6 M^ Pareto (P) 
fj(P) = 0, 

VP £ V N such that M Condorcet (P) ^ 0 and j £ M^ Condorcet (P) 


(Unanimity) 


(Pareto) 


(Condorcet) 


The next example illustrates that, unlike anonymity and neutrality, unanimity does 
not come for free in terms of the mechanisms’ signatures. Since Pareto optimality and 
Condorcet consistency imply unanimity, the same is true for both other desiderata. 
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Example 4. Consider the same problem as in Section 9.2, where n = m = 3, agents 
have strict preferences over alternatives a, b, c, 5 is the worst-case deficit based on Veto 
scoring. Let <p be a strategyproof mechanism that is also unanimous. 

By the characterization in (Gibbard, 1977), p must be a hybrid of strategyproof 
unilateral and strategyproof duple mechanisms. However, for m ^ 3 alternatives, no 
duple mechanism is unanimous, and unilateral mechanisms are unanimous only if they 
always select the first choice of the dictating agent. But as soon as a single component of 
a hybrid is not unanimous, the hybrid is not unanimous either. Consequently, p must be a 
hybrid of dictatorships. Since unanimity is an anonymous and neutral constraint (i.e., the 
constraint is invariant to renamings of agents or alternatives), we obtain from Corollary 
3 that the signature of p is at most as good as the signature of Random Dictatorship, 
where the dictating agent is chosen uniformly at random. However, Random Dictatorship 
has a deficit of | at the preference profile 


(23) 

(24) 


Pi, P 2 : a > b > c, 
P 3 : c > b > a. 


But we already observed that Random Duple is strategyproof and optimal (but not 
unanimous) in this problem with strictly lower deficit of |. This means that requiring 
unanimity in this problem leads to a strict increase in the lowest deficit that is achievable 
with strategyproof, optimal mechanisms. 

C.4. Symmetric Decomposition of Strategyproof, Anonymous, and 
Neutral Mechanisms 

We present a refinement of Gibbard’s strong characterization of strategyproof mechanisms 
(Gibbard, 1977). Our symmetric decomposition characterizes mechanisms that are 
strategyproof, anonymous, and neutral. We use this result to establish the shapes of 
Pareto frontiers in Sections 9.2 analytically. Beyond this application, the symmetric 
decomposition may be of independent interest. 

In the full domain of strict preferences, Gibbard (1977) showed that any strategyproof 
mechanism is a hybrid of multiple “simple” mechanisms, namely strategyproof unilateral 
and duple mechanisms. 
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Definition 17 (Gibbard, 1977). A mechanism uni is unilateral if the outcome only 
depends on the report of a single agent; formally, there exists i e N such that for all 
preference profiles P.P' e V N we have that Pi = P[ implies uni(P) = uni(P / ). 

Definition 18 (Gibbard, 1977). A mechanism dup is duple if only two alternatives are 
possible; formally, there exist a,b s M such that for all preference profiles P e V N we 
have dup ? (P) = 0 for all j a, b. 

The strong characterization result is the following. 

Fact 1 (Gibbard, 1977). A mechanism ip is strategyproof if and only if it can be written 
as a hybrid of mechanisms p 1 , ..., p K , and each component p k is strategyproof and either 
unilateral or duple. 7 

Obviously, duple mechanisms cannot satisfy neutrality (unless m = 2) and unilateral 
mechanisms cannot satisfy anonymity (unless the mechanism is constant or n = 1). This 
means that anonymity and neutrality of strategyproof mechanisms are the result of 
mixing the unilateral and duple components “correctly.” This intuition gives rise to the 
following more refined decomposition of strategyproof, anonymous, neutral mechanism. 

Theorem 4 (Symmetric Decomposition). A mechanism p is strategyproof, anonymous, 
and neutral if and only if there exist 

1. strategyproof, neutral, unilateral mechanisms uni k , k e {1,..., K um ), 

2. strategyproof, anonymous, duple mechanisms dup k , k e { K um + 1,..., K um + K dup }, 

3. coefficients j3 k ^ 0, k e {1,..., K um + K dup } with Yjk=\ +A P Pk = 1, 

such that 



bijection bijection 


Proof. By anonymity and neutrality of p we get that 

p = (p*r = r = ^ ( 26 ) 

7 Gibbard further refined this result by replacing strategyproofness with localized and non-perverse. 
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for all bijections n : N N and w : M —» M , which implies 


ip = 


2 


1 


n\m\ 


■ 


(27) 


Since <^ 1T ’ TO is strategyproof, we can use Fact 1 to decompose it into /f r, ° strategyproof 
unilateral and duple mechanisms, i.e., 


if 71 


v" - 2 ft 




(28) 


k= 1 


By symmetry, the decomposition can be chosen such that for any pair of renamings 7 r, cjj 
and k e { 1 ,..., Jl 7 "’®} we have 

• Ji uni + A' dup = Jl 7 ^, 

• a = pr, 

• if </? fc = if k ’ ld ’ ld is a strategyproof unilateral (or duple) mechanism, than <^ fc ’ 7r ’ ro is a 
strategyproof unilateral (or duple) mechanism with if^_ 

• without loss of generality, f k is unilateral for k e {l,...,A' um } and duple for 
k e {AT uni + 1,..., A" uni + A' dup }. 

Averaging over all renamings tt, w we get 


¥> = 


JfTT.w ^uni + ^dup 

j- \ X ^ /~\ nr m 1U -tt- *r-r X ^ X ^ l Pk 


HbSS 1 


n\m\, , „ 

7T,Ia7 x 7 /c = l 


'CU ,TT ,-UJ _ 


2 2 

/c = 1 7T,-Ci7 


n!m! 




fc, 7T,-CC7 


(29) 


If (^ fc - ld > ro is strategyproof and duple, then 


dup‘-” - 2 


n\ 


A 


k,Tr,TX 7 


(30) 


is strategyproof and duple as well. Similarly, if ^ fc,7r ’ ld is strategyproof and unilateral, 
then 


uni fc,7r = 


2 


1 


m\ 


A 


k,7r ,zn 


(31) 
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is strategyproof and unilateral as well. With this we can rewrite (29) as 


2 ^dup*'", (32) 

ml 

■ CE7 

which is precisely the symmetric decomposition (25). □ 

The symmetric decomposition (25) is a consequence of Gibbard’s strong characteriza¬ 
tion and the fact that for any anonymous, neutral mechanism we have (p = (p n ’™. It is 
symmetric in the sense that for any component uni fe (or dup A: ) that occur with coefficient 
/3k, the corresponding component uni fe,7r (or dup^’ ro ) occur with the same coefficient. 
(25) decomposes <p into two parts: a neutral part on the left, that gets “anonymized” 
by randomization, and an anonymous part on the right that gets “neutralized” by 
randomization. 


k um 

k=l 7T 


^-uni fc,7r + 
n\ 


x uni +x du p 

2 

k = K uni + 1 


C.5. Connection to Gibbard’s Strong Characterization of 
Strategyproof Random Mechanisms 

In Section 9.2 we have studied the Pareto frontier for two different desiderata, namely 
Plurality and Veto scoring. Juxtaposing the two examples shows an interesting connection 
to earlier work that characterized strategyproof random mechanisms: Gibbard (1977) 
showed that in a domain with three or more alternatives and strict preferences, any 
mechanism that is strategyproof must be a probability mixture (i.e., a hybrid with an 
arbitrary number of components) of strategyproof unilateral mechanisms (i.e., whose 
random outcomes depend only on the preference order of a single agent) and strategyproof 
duple mechanisms (i.e., which assign positive probability to at most two alternatives). 

Our examples show that the optimal strategyproof mechanisms for the particular 
problems are exactly the two extremes of this representation: when the desideratum is 
based on Plurality scoring, optimal strategyproof mechanism arise by randomizing over 
unilateral mechanisms only, namely dictatorships. Conversely, when the desideratum 
is based on Veto scoring, optimal strategyproof mechanisms arise by randomizing over 
duple mechanisms only, namely the majority vote between two alternatives. Thus, our 
two examples teach us in what sense unilateral and duple mechanisms can be understood 
to reside on “opposite ends” of the spectrum of strategyproof mechanisms. 


44 


ALGORITHM 1: FindBounds_ 

Input: bound s > 0 

Variables: set of supporting manipulability bounds supp.bnds, stacks of unverified, verified, 

and outer segments segments.u, segments.v, segments.o 

begin 

supp.bnds <— {0} 

segments.u <— {{signature's), signature^ 1))} 

segments.v <— 0 

segments.o <— {{signature^ 0), signature's )), {signature{ 1), signature^ 2))} 

while segments.u / 0 do 

(P~.P + ) <— pop (segments.u) 

(P~ _ , P _ ), (P + , P ++ ) e segments.v u segments.u u segments.o 

e <— {affine.hull ({P , P~}) n affine.hull ({P , P _ })) £ 

P <— signature{e) 

if P e {affine.hull ({P , P~}) n affine.hull{{P + , P ++ })) then 

supp.bnds <— supp.bnds u {P} 

segments.v <— segments.v u {(P , P _ ), (P + , P ++ ), (P _ , P) , (P, P + )} 

end 

else if P e affine.hull{ P~,P + ) then 

segments.v <— segments.v u {(P P + )} 

end 
else 

segments.u <— segments.u u {(P~ P),(P^ + )} 
end 
end 

return supp.bnds 
end 


D. The Algorithm FindBounds 

Knowing the structure of the Pareto frontier from Theorem 3, we can take a more refined 
approach to the problem of identifying the Pareto frontier (than applying FindOpt 
to various manipulability bounds). The algorithm FindBounds (Algorithm 1) applies 
FindOpt sequentially to determine the signatures of optimal mechanisms at different 
manipulability bounds. It uses the information obtained in each step to interpolate the 
most promising candidates for supporting manipulability bounds. 

Before we state our formal result about the correctness, completeness, and runtime 
of FindBounds, we provide an outline of how the algorithm works. Observe that by 
Theorem 3, the problem of computing all supporting manipulability bounds is equivalent 
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ALGORITHM 2: FindLower _ 

Variables: signatures sign 0 , sign, sign + , bound e 
begin 

e <— 1/2 

sign 0 <— signature (0), sign + <— signature^ 1), sign signature's) 
while sign ^ affine.hull( sign 0 , sign + ) do 
| sign + <— sign, e <— e/2, sign <— signature's) 

end 

return s 
end 


to identifying the path of the monotonic, convex, piecewise linear function £ *-*• 5(e). 
FlNDBoUNDS keeps an inventory of “known signatures” and “verified segments” on this 
path. It uses these to interpolate and verify new segments. 

Interpolation: Suppose that we know four points s 0 = (£ 0 ,5o); s i = (£i,5i),s 2 = 
(£ 2 , 52 ), S 3 = (£ 3 , 63 ) with £ 0 < £1 < £ 2 < £3 on the path. If the two segments 
So -Si and S 2 S 3 are linearly independent, their affine hulls have a unique point of 
intersection e' over the interval [£i,£ 2 ]. This point of intersection is the candidate 
for a new supporting manipulability bound that FindBounds considers. The left 
plot in Figure 8 illustrates the geometry of this step. 

Verification: Once we have identified the candidate e', we use FindOpt to compute 
the deficit 5' = S(e'). The signature (e 1 ,5') is either on or below the straight line 
connecting the signatures (£ 1 , 5 2 ) and (£ 2 , <5 2 ). br the first case, if all three signatures 
lie on a single straight line segment, then we can infer that this line segment must 
be part of the path of £ 6 (e). We can mark this segment as “verified,” because 

there are no supporting manipulability bounds in the open interval (£i,£ 2 ) (but 
possibly at its limits). In the second case, if (£', 5') lies strictly below the line 
segment, then there must exist at least one supporting manipulability bound in the 
open interval (^,£ 2 ) at which the path has a real “kink.” The right plot in Figure 
8 illustrates the geometry of this step. The signature (£', 6') must he somewhere 
on the gray vertical line at s’. 

In this way FindBounds repeatedly identifies and verifies line segments on the path of 
£ 1 —* <5(£). If no additional supporting manipulability bounds exist on a segment, then 
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Figure 8: Illustration of interpolation (left) and verification step (right). 

this segment is verified. Otherwise, one more point (e', 6') is added to the collection of 
known signatures, and the algorithm continues to interpolate. 

Next, we prove Proposition 3. 

Proof of Proposition 3. Given a problem (N,M,S), the algorithms FindLower and 
FindBounds require at most AK + log 2 (l/o) — 1 executions of the linear program 
FindOpt to determine all supporting manipulability bounds of the Pareto frontier, where 
K is the number of supporting manipulability bounds and is the smallest non-trivial 
supporting manipulability bound. 8 

We defined signature (e) (or sign(e) for short) as a function that uses the linear program 
FindOpt to determine the signature of some mechanism that is optimal at e, i.e., (e, 5(e)). 
Algorithm FindLower initially calls to the function sign 3 times, for 0, 1, and 1/2. Now 
suppose that £]_ e [^, ^r) for some n A 1. Then sign will be called for |, |,..., ^/rr 
until s = is returned. Note that while £= ^ would have been sufficiently small, the 
algorithm needs to try £ = to verify this. Thus, it takes n = log 2 (l/ei) calls to sign. 

The remainder of the proof is concerned with the algorithm FindBounds. Any 
segment consists of two points (sign(e), sign(e')). Initially, there are two outer seg¬ 
ments (sign(0 ), sign(e )) and (sign( 1), sign(2 )), which are needed to help the algorithm 

8 For technical reasons, FindBounds assumes knowledge of some value ee (0,£i], i.e., some strictly 
positive lower bound for the smallest non-trivial supporting manipulability bound. This is needed to 
initialize the interpolation process. Algorithm FindLower (Algorithm 2 identifies a suitable value 
of e. 
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get started. The algorithm maintains a decomposition of the interval [e, 1], which initially 
consists of a single unverified segment. In every execution of the while-loop, FlND- 
Bounds selects an unverified segment (sign(e~), sign(e + )). Then it uses the segments to 
the left and right ( sign(e ), sign(e ~)) and ( sign(e + ), sign(e ++ )) to “guess” the position 
of a new supporting manipulability bound between and e + . This guess e is the e -value 
of the point of intersection of the affine hulls of the two segments, i.e., 

e = (affine.hull ({sign(e ), sign(e~)}) n affine.hull ({sign(e + ), s^n(e ++ )})) £ , (33) 

where affine.hull denotes the affine hull. This value is unique and lies inside the open 
interval (e~,£ + ) (by Claim 1). Now P = sign(e) is computed using the linear program 
FindOpt, and one of three cases can occur: 

1. P may be equal to the unique point of intersection 

affine.hull ({sign(e ), sign(e~)}) n affine.hull ({sign(e + ) : sign(e ++ )}) . (34) 

In this case, e is a supporting manipulability bound. Furthermore, the segments 
( sign(e ), sign(e~)), (sign(e~), P), (P, sign(e + )), and (sign(e + ), sign(e ++ )). are 
all part of the signature of the Pareto frontier (by Claim 3), and there are no 
other supporting manipulability bound in the interval (e , £ ++ ). FlNDBoUNDS 
marks the four segments as verified and includes e in the collection of supporting 
manipulability bounds. 

2. P lies in the affine hull of the segment (sign(e~), sign(e + )). Then by Claim 2, 

Conv ({sign(e~), P}) u Conv ({P, s*^n(e + )}) (35) 

is part of the signature of the Pareto frontier, and there are no supporting ma¬ 
nipulability bounds inside the interval ( e~,e + ). FindBounds marks the segment 
(sign(e~), sign(e + )) as verified. 

3. In any other case, FindBounds splits the segment ( sign(e ~), sign(e + )) by creating 
two new unverified segments 

(sign(e~), P) and (P , sign(e + )) . (36) 
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We first show correctness of FlNDBoUNDS, then completeness: 

Correctness FindBounds stops running when there are no more unverified segments. 
Assume towards contradiction that there exists a supporting manipulability bound 
e e (e, 1) that has not been identified. Then this supporting manipulability bound 
lies in some segment [£ _ ,£ + ] that was verified. 

If the verification happened in a case f, Claim 3 ensures that there is no other 
supporting manipulability bound, i.e., the supporting manipulability bound would 
have been added to the collection during the analysis of the interval (e , £ ++ ). 

If the verification happened in a case 2, Claim 2 ensures that £ f (£ _ ,£ + ), so 
that £ = e~ (without loss of generality we can assume £ = £“, the case £ = £ + 
is analogous). The segment ( sign(e ),sign(e ~)) was not a verified segment at 
this time, otherwise this would be a case f. Thus, at some future step some 
segment (sign(e), sign{e~)) with a right end-point in sign(e ~) was verified. But 
at this step sign{e ~) was on the intersection of the affine hulls of the segments 
( sign(e ), sign(e )) and (sign(e~), sign(e + )). This creates a case f, and thus £ was 
identified as a supporting manipulability bound in this step. 

Completeness It remains to be shown that FindBounds stops at some point. By Claim 
4, for ever two adjacent supporting manipulability bounds £fc,£fc+i, FindBounds 
computes at most three points sign(e'), sign(e"), sign{e"') with £',£", s'" e (£^,£^+ 1 ). 
Since there is a finite number of supporting manipulability bounds, FindBounds 
loops at most 3 + 1=4 times per interval, which establishes completeness. The 
run-time bound follows by observing that there exist K — 2 intervals between the 
smallest non-trivial bound £\ and the largest bound £. However, we may need to 
check the interval (e, 1) if e < 1. Thus, using s from FindLower we require at 
most 4 K — 4 executions of FindOpt to run FindBounds. 

Claim l.ee (£ _ ,£ + ) 

Proof. By convexity of £ 5(e ), we get that e e [£“,£ + ], 

Now suppose that e = e~. Then £“ e affine.hull({sign(e + ), sign(e ++ )}). Since £~ < 
£ + , the segments ( sign(e ~), sign(e + )) and ( sign(e + ), sign(e ++ )) would have been verified 
in a previous step. But this is a contradiction to the assumption that ( sign(e ~), sign(e + )) 
was an unverified segment. □ 
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Claim 2. For 0 ^ £_i < £ 0 < Si ^ 1, if 


sign(£o ) e Conv({sign(£_i), sign(si )}), (37) 

then 

Conv({sign(£_i), signal)}) (38) 

zs pari of the signature of the Pareto frontier. 

Proof. Assume towards contradiction that Conv({sign (£_ x ), signal)}) is not part of the 
signature of the Pareto frontier. Then by convexity of e •—* 6(e) there exists 7 e (0,1) 
with 

%(i — 7) e -l+7 £ l ) < (I-tM^s-J+ 7^ ei )- (39) 

If s' = (1 — 7 )e_i + 7 £i > £ 0 , then for 7 ' = we get 

(1 - Y)S(<p e _ 1 ) + T^fav) < <5(V>eo) = %(i- 7 ') e _ 1 + 7 v), (40) 

a contradiction to convexity of £ >—> 5(e). The argument for s' < £0 is analogous. □ 
Claim 3. For 0 A £-2 < £-1 < £0 < £1 < £2 < 1, if 

{ sign(£)} = affine.hull({sign(£_ 2 ), sign(£_i )}) n affine.hull ({signal), sign(£ 2 )}), (41) 

then 

Conv({sign(£ 0 ),sign(£ ±2 )}) (42) 

is part of the signature of the Pareto frontier. 

Proof. The claim follows by applying Claim 2 twice. □ 

Claim 4. For any two adjacent supporting manipulability bounds £k,£k+ 1 , FindBounds 
computes at most three points signup), sign(s"), sign(s '") with s',s",s'" e (e fe ,£ fc+1 ). 

Proof. Suppose that sign(£'), sign(£ ,r ), and sign(s'") are computed in this order. If 
£ m < min(£ , ,e ,, ) ) then s' must be a supporting manipulability bound by convexity 
of £ 1 —* 5(e), which is a contradiction. The same holds if s'" > max(£ / ,£ // ). If s'" e 
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(min(e', e"), max(£', £")), the segment 


(sign( min(e / , e")), sign(max(e' , e"))) (43) 

is verified (case (2)). Another guess e"" that lies within [£*.,£*. + i] involve the segment 
( sign(e '), sign{e")). Thus, by convexity of £ 6(e), e"" is a supporting manipulability 

bound. □ 

This concludes the proof of Proposition 3 □ 

The interpolation process in FindBounds is set up in such a way that at most 4 
executions of FindOpt are required for finding each supporting manipulability bound. 
Thus, assuming that representatives of OPT(£ fc ) must be determined by executing 
FindOpt at each £&, FindBounds is at most a constant factor 4 slower than an algorithm 
that correctly “guesses” all supporting manipulability bounds and uses FindOpt for 
these only. 

E. Alternative Domains and Desiderata 

With the exception of the examples in Sections 9.2, we have formulated our results for 
the general domain with weak preferences. In the following Section E.l, we explain 
how our findings continue to hold in many other interesting domains. Subsequently, in 
Section E.2, we discuss the expressiveness of desideratum functions for the purpose of 
encoding desiderata. 

E.l. Domain Restrictions 

We have proven our results (Theorems 1 through 3 and Proposition 2) for the unrestricted 
preference domain with indifferences. However, all these results continue to hold when 
the domain is restricted by only admitting a subset of the possible preference profiles. 
Formally, let P Q V N be any subset of the set of preference profiles; then all our results 
still hold, even if we admit only preference profiles from P. This extension is possible 
because none of our proofs make use of the richness of the full domain. 

Important domains that can be expressed as domain restrictions P c V N are: 
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• The full domain of strict ordinal preferences, which is the basis for the classical 
impossibility results pertaining to strategyproofness of deterministic mechanisms 
(Gibbard, 1973; Satterthwaite, 1975) and random mechanisms (Gibbard, 1977). 

• The assignment domain, where each agent must be assigned to a single, indivisible 
object (e.g., a seat at a public school) (Abdulkadiroglu and Sonrnez, 2003). 

• The two-sided matching domain, where agents of two different types must be 
matched to each other to form pairs (e.g., men and women, doctors and hospitals, 
mentors and mentees), and variations of this domain, such as matching with couples 
(Roth, 1984). 

• The combinatorial assignment domain, where agents receive bundles of indivisible 
objects (e.g., schedules with multiple courses) (Budish, 2011) 

Of course, the fact that our results continue to hold in these domains does not mean that 
the actual Pareto frontiers will be equal across the different domains. On the contrary, 
one would expect optimal mechanisms to be highly adapted to the particular domain in 
which they are designed to operate. 

Remark 7 (Full Utility Assumption). One essential ingredient to our results is the fact 
that ^-approximate strategyproofness can be equivalently expressed via a finite set of 
linear constraints. Theorem 1, which yields this equivalence, relies on the assumption 
of full utility, given a preference order Pi, the agent i can have vNM utility function 
Ui e Up i that represents this preference order (and is bounded between 0 and 1). A 
domain restriction that excludes subsets of utility functions would violate this condition. 
For example, suppose that we imposed the additional restriction that the agent’s utility 
are normalized (i.e., ||itj| 2 = u i(j) 2 = !)■ This restriction limits the gain that an 

agent can possibly obtain from misreporting in a non-linear way. The linear constraints 
from Theorem 1 would be sufficient for ^-approximate strategyproofness. However, they 
would no longer be necessary, and we would lose equivalent. 

E.2. Encoding Desiderata via Desideratum Functions 

desideratum functions are a very versatile means to express different design goals that 
the mechanism designer may have. We have already seen how they can be used to reflect 
desiderata based on Plurality scoring (Example 1), Condorcet consistency (Examples 
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2), or Veto scoring (Section 9.2). We now give additional examples that illustrate how 
desideratum functions can be used to encode common desiderata. 


Binary Desiderata Many desirable properties of mechanisms are simply properties 
of the alternatives they select at any given preference profile. For instance, Pareto 
optimality requires the mechanism to choose alternatives that are not Pareto dominated 
by any other alternative at the respective preference profile. In general, let 0 be a 
desirable property that an alternative can have at some preference profile (e.g., Pareto 
optimality). Desideratum functions can capture 0 by setting 


d(j,P) 


1, if alternative j has property 0 at P, 
0, else. 


The d-deficit of a mechanism at a given preference profile, 


(44) 


&d(<p(P),P) = ma xd(j,P) - V <pj(P) ■ d(j,P), (45) 

7 EM 

jeM 

has a straightforward interpretation: it is simply the “probability that an alternative 
selected by ip at P violates property 0 at P.” Consequently, if S is the worst-case deficit, 
then the probability that ip selects an alternative that violates © is at most 5(<p) across 
all preference profiles. Alternatively, if d p is the ex-ante deficit, then <5 p (<p) is the ex-ante 
probability (i.e., before the preferences have been reported) that selects an alternative 
that violates 0, given the prior distribution P over agents’ preference profiles. 

Common binary desiderata include 

• unanimity: if all agents agree on a first choice, this alternative should be selected, 

• Condorcet consistency, if some alternatives weakly dominate any other alternatives 
in a pairwise majority comparison, one of these alternatives should be selected, 

• Pareto optimality, only undominated alternatives should be selected, 

• egalitarian fairness: let R(j) = max^/v rank p. (j ) be the rank of alternative j in 
the preference order of the agent who likes it least, then only alternatives with 
minimal R(j) should be selected. 

While not all of these desiderata are in conflict with strategyproofness individually, 
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their combinations may be. It is possible to encode combinations of binary properties: 
given two desideratum functions d± and d 2 , the minimum d = min(di,d 2 ) is again a 
desideratum function, and it expresses the desideratum that both properties (encoded 
by d\ and d 2 ) should hold simultaneously; and the maximum d = max(d!,d 2 ) expresses 
that at least one of the properties should hold. 

Even in the absence of a clear-cut objective, a desideratum may be implicitly specified 
via a target mechanism. A target mechanism 0 is a mechanism that one would like 
to use if there were no concerns about manipulability (Birrell and Pass, 2011). The 
desideratum function induced by f takes value 1 at the alternatives that are selected by 
(j) at the respective preference profiles, or equivalently, d(j,P ) = ci>j(P ). An analogous 
construction is possible for a target correspondence T, which is a mechanism that selects 
a set of alternatives. To reflect a target correspondence, the desideratum function can be 
chosen as d(j, P) = 1 if j e $(P) and d(j, P ) = 0 otherwise, where we denote by &(P) 
the set of alternatives selected by the correspondence $ at P. 

In the assignment domain, our notion of Pareto optimality turns into ex-post effi¬ 
ciency, which is an important baseline requirement for many assignment mechanisms. 
Featherstone (2011) introduced v-rank efficiency, which is a refinement of ex-post effi¬ 
ciency (and implies ordinal efficiency). He showed that for any rank valuation v, the 
set of v-rank efficient assignments is equal to the convex hull of the set of deterministic 
v-rank efficient assignments. Thus, v-rank efficiency is representable by a desideratum 
function by setting d(a, P ) = 1 for all alternatives a that correspond to a v-rank efficient 
deterministic assignment. In two-sided matching, it is often important to select stable 
matchings to prevent blocking pairs from matching outside the mechanism and thereby 
causing unraveling of the market. Since stability is a property of deterministic matchings, 
we can encode this desideratum by a desideratum function. 

With any such desideratum function in hand, we can then define a notion of deficit 
and use the results in this paper to understand the respective Pareto frontier. 

Remark 8 (Linearity Assumption). One example of a desideratum that cannot be 
represented by a desideratum function is the intermediate efficiency requirement of 
ordinal efficiency for assignment mechanisms. To see this, note that ordinal efficiency 
coincides with ex-post efficiency on deterministic assignments. However, the convex 
combination of two ordinally efficient assignments is not necessarily again ordinally 
efficient. In general, to be able to encode a desideratum via a desideratum function, the 
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societal value of any random outcome x must depend in a linear fashion on the societal 
value of the individual alternatives (see Definition 5). Ordinal efficiency violates this 
requirement. 


Quantifiable Desiderata In some situations, there exists a quantified notion of the 
desirability of different alternatives at different preference profiles. Straightforward 
examples are desiderata based on positional scoring. Formally, a scoring function 
v : {1,..., m} —> R is a mapping that associates a score v(r) with selecting some agent’s 
rth choice alternative. Typical examples include Borda (i.e., v{r ) = m — r for all 
re {1,... , m}), Plurality (i.e., u(l) = 1 and v(r) = 0 for r ^ 1), and Veto (i.e., v{r ) = 0 
for all r V m and v(m) = — 1). The score of an alternative at a preference profile is 
then determined by summing the scores of this alternative under the different preference 
orders of the agents. Formally, 


sc v (j,P) = u(rank P .(j)), 

ieN 


(46) 


where rankp. (j) is the rank of alternative j in preference order Pp For any scoring-based 
desideratum, the respective desideratum function arises by scaling sc„ as follows: 


d(j,P) 


sc„(yP)-miny eM sc v (j',P) 
max j'eM sc„(j',-P)-min J , eM sc„(j',P) ’ 


0, 


if rnax /eM sc„(j', P) > min /eM sc v {j',P) 
else. 


In the assignment domain, the rank valuation v is used to determine the u-rank value 
of any assignment. This induces a scoring function on the corresponding alternatives. 
Consequently, instead of viewing u-rank efficiency as a binary desideratum, the quantified 
desideratum could be to maximize the w-rank value. This natural measure of societal 
value was put forward by Featherstone (2011). 

In quasi-linear domains, a common objective is to maximize the sum of the agents’ 
cardinal utilities. For situations where this aggregate value is interesting, Procaccia and 
Rosenschcin (2006) proposed to maximize a conservative estimate of this value instead. 
This (slightly unorthodox) desideratum is also representable by a desideratum function. 
Even though the vNM utilities in our model do not have to be comparable across agents, 
one may choose to maximize the sum of these utilities. However, since agents only report 
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ordinal preferences, we cannot maximize their utilities directly. Instead, we can maximize 
a conservative estimate for this sum. Formally, the respective desideratum would be to 
maximize 

d(j,P)= inf ( 47 ) 

u l eUp 1 ,...,u n eU Prl ^ 

Recall that we bounded utilities between 0 and 1, and let us assume that ma xj eM u i (j ) = 1- 
Then the aggregate utility from any outcome x e A(M) is lowest if agents have utility 
(close to) 0 for all except their first choices. Thus, maximizing the conservative lower 
bound for aggregate utility in our model corresponds to selecting an alternative that 
is the first choice of as many agents as possible. This is equivalent to the quantitative 
measure of societal value induced by Plurality scoring. 

F. Omitted Proofs 

F.l. Proof of Theorem 1 

Proof of Theorem 1. Given a setting (N,M), a bound e e [0,1], and a mechanism p, 
the following are equivalent: 

1. p is e-approximately strategyproof in (. N,M ). 

2. For any agent is N, any preference profile (Pj, P_f) s V N , any misreport P[ s V, 
and any rank r s {1,..., m}, we have 

2 ftW'.-P-i)(48) 

jeM:rankp i (j)^r 


Fix an agent i, a preference profile (Pj,P_j), and a misreport P[. The admissible 
set of utility functions for agent i is Pp., i.e., all the utilities Ui : M —* [0,1] for which 
Ui(j) ^ Ui(j') whenever p : j > f. Let P^ 0,1 ^(p) denote the set of binary utilities 
associated with Pi , i.e., 

^{°. 1 l(p.) = : M — >• (0,1} | u(j) ^ u(j') whenever P : j > j'} . (49) 

We first show the direction i.e., the condition 2 implies e-approxirriate strate- 
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gyproofness (1). Let u e B^ 0,1 ^(Pi), then the incentive constraint (3) for this particular 
utility function has the form 

p;,f) - 

jeM 

jeM:u(j )=1 

2 Vj(Pl,P-i)-V>j(Pi,P-i) 

jeM-.rank p i (j)^r 

for some fc 6 {l,...,m}. By (48) from the condition 2, this term is always upper 
bounded by e. By Lemma 1, Up i Q Conv (p{ 0,1 7(Pj)), which means that any Ui e Up t 
that represents the preference order P* can be written as a convex combination of utility 
functions in P^ 0,1 )(Pj), i.e., 

L 

Ui = ^aiu l (53) 

i=i 

for u l e P^ 0,1 ^(Pj) and cp ^ 0 for all l e {1,..., L} and Yji=i a i = 1- By linearity of the 
incentive constraint (3) we get that 

L 

e{ui, (Pi,P-i) ,Ph<p) = (m z , (P*,P_i) , J F’ / ,(^) 

i=i 
L 

Yj oti£ = £- 

i=i 

This proves the direction 

Next, we prove the direction Towards contradiction, assume that the constraint 

(48) is violated for some k e {1,..., m}, i.e., 


(54) 

(55) 


(50) 

(51) 

(52) 


2 n (P„P- i )-<p j (P i ,P- i )=e + S 

jieM:rankp. (j)^k 


(56) 


with S > 0. Let u e pi 0 ’ 1 ! (P-) be the binary utility function with 


u{j) = 


1, if rankp.(j) ^ k, 
0, else. 


(57) 
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Then 


£ (u, (Pi, P-i) i Pi ip) = £ + S. (58) 

Choose any utility function u! e Up i and let /3 = e +$ +1 - The utility function constructed 
by w = (1 — (3)u + f3v! represents P t and we have 

e (u, (P i} P_i), Pi ip) = (1 - P)e (u, (Pi, P-i), Pi ip) + Pe (u', (Pi, P-i), P', ^) (59) 

^ (1 -p)( E + S)-p ( 60 ) 

= — P(e + S + 1 ) + (e + 5 ) = £ + S/2, ( 61 ) 

since the change in utility from manipulation is lower bounded by — 1. Thus, the 
^-approximate strategyproofness constraint is violated (for the utility function u, a 
contradiction. 

Lemma 1. For any preference order P e V define the set of binary utilities associated 
with P by 


B^ 0 P(P) = (u : M —> {0,1} | u(j) ^ u(j') whenever P : j > j'} . (62) 

Then Up Conv (B^ 0,1 ^(P)), where Conv(-) denotes the convex hull of a set. 

Proof of Lemma 1. First, suppose that the preference order P is strict, i.e., P : j > j 1 
or P : j' > j for all j ^ f , and without loss of generality, 

P ■ Ji > 32 >■■■ > 3m- (63) 


In this case, B^P(P) consists of all the functions u r : M —» {0,1} with 


u k (j r ) 


1, if r ^ k, 
0, else. 


(64) 


With k e 0Let Am(0) = 1 — u(j\), A u(k) = u(jk) — u(jk+i) for all k e 
{1,..., m — 1}, and A u(m) = u(j m ). Then represent u by 


m 


u (jr) = J] Au ( k )- 
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(65) 



Now we construct the utility function 


u = ^ A u(k) ■ u k . (66) 

k =o 

First note that XlfcLo Au(k) = 1 and A u(k) ^ 0 for all k, so that u is a convex combination 
of elements of B^ 0,1 ^(P). Furthermore, for any j r e M, we have that 


m 


2 A u(k) ■ u k (j r ) 

(67) 

k= 0 

m 

2 A u(k) = u(j r ), 

k=r 

(68) 


(69) 


i.e., u = u. This establishes the Lemma for strict preference orders. 

For arbitrary preference orders (i.e., with indifferences) the proof can be easily extended 
by combining all alternatives about which an agent with preference order P is indifferent 
into a single virtual alternative. Then we apply the proof for the strict case. The 
utility functions in B^ 0,1 ^(P) will be exactly those that put equal value on the groups 
of alternatives between which an agent with preference order P is indifferent. This 
concludes the proof of the Lemma. □ 

This concludes the proof of Theorem 1. □ 

F.2. Proof of Proposition 1 

Proof of Proposition 1. Given a problem ( N , M, <5) and a manipulability bound e e [0, 1], 
there exists at least one mechanism that is optimal at e. 

A strategyproof mechanism always exists (e.g., the constant mechanism), and any 
strategyproof mechanism is also e-approximately strategyproof. Thus, the set of candi¬ 
dates for OPT(e) is never empty. Since the deficit of any mechanism is upper bounded 
by 1, we get 5(e) < 1 for all e e [0,1]. Next, for some e e [0,1] let 

5(e) = inf (h(^) | p ^-approximately strategyproof}. (70) 
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By definition (of the infimum), there exists a sequence of mechanisms (pkjk^i such that 
5(p k ) — > 5(e) as k — » go. Since all pk are mechanisms, they are uniformly bounded 
functions from the finite set of preference profiles to the compact set A (M). Therefore, 
some sub-sequence of (pk)k^i converges uniformly to a limit p, which must itself be a 
mechanism. 

By Theorem 1, e -approximate strategyproofness is equivalent to a finite set of weak, 
linear inequalities. Since these are all satisfied by the elements of the sequence (pk)k^i, 
they are also satisfied by p, i.e., p is an ^-approximately strategyproof mechanism. The 
deficit of a mechanism p is either a maximum (worst-case deficit) or a weighted average 
(ex-ante deficit) of a finite set of values, but in any case, it is a uniformly continuous 
projection of <p onto the compact interval [0,1]. Thus, by uniform convergence, the 
deficit of 5 (ip) must be the limit of the sequence of deficits (5(pk))k^ l, he., 5(e), which 
yields ip s OPT(e). □ 

F.3. Proof of Theorem 2 

Proof of Theorem 2. Given a problem (N,M,5), mechanisms p,if, and (3 s [0,1], we 
have 

£(h 0 ) < (1 ~ P)e(v) +Pe(i/j), ( 71 ) 

5(h p ) ^ (1 -P)8(<P)+Pm- ( 72 ) 


The manipulability of a mechanism is determined by the maximum manipulability 
across all agents i e N, preference profiles (Pi, P_f) e V N , and misreports P[ e V. Using 
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the triangle inequality for this max-operator, we get that 


e(hp) = maxe(u, (P*, P-i ), P', hp) (73) 

- max 2 «,0) ■ ((Mj (Pl,P-i)-(hn) i (P l ,P- l )) P4) 

jeM 

< (1-/3) max Mi(j) • (c pj(P■, P-i) - <pj(Pi , P_i)) (75) 

jeM 

+/5 max Ui(j) ■ (ipj(P'-, P-i ) - ^(P*, P-*)) (76) 

jeM 

= (1 ~ P)e{v) + /MV0- (77) 


For worst-case deficit, observe that the extended desideratum function for random 
outcomes is linear in the first argument, i.e., d(( 1 — f3)x + /3y,P) = (1 — /3)d(x,P ) + 
j3d(y,P) for any outcomes x,y preference profile P. Thus, 

5{hp) = ma xS(hp(P),P) < (1 - P)e((p) + pe(if) (78) 

follows analogously. Since the ex-ante deficit is simply a single linear function of the 
mechanism, we get exact equality, i.e., 6(hp) = (1 — P)e(p) + Pe(i])). □ 

F.4. Proof of Corollary 1 

Proof of Corollary 1. Given a problem (N, M, 5), the mapping e >6(e) is monotonically 
decreasing and convex. 

Monotonicity follows (almost) by definition: observe a mechanism p e OPT(e) is also a 
candidate for Opt(P) for any larger manipulability bound s’ ^ e. The only reason for p 
to not be optimal at e' is that some other e'- approximately strategyproof mechanism has 
strictly lower deficit. Thus, the mapping e 6(e) is weakly monotonic and decreasing. 

To see convexity, assume towards contradiction that the mapping is not convex. Then 
there must exist bounds £, e' e [0, 1] and P € [0,1], such that for £p = (1 — /3)e + f3e', we 
have 

S(ep) > (l - P)6(e) + P6(e'). (79) 

Let p e Opt(s) and p' e Opt(P) and consider the hybrid hp = (1 — /3)p + /3p'. By 
Theorem 2, this hybrid has a manipulability of at most £p and a deficit of at most 
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(1 — j3)S(e) + /3S(e'). Thus, 


5(e p ) ^ 5(hy) < (1 - P)5{e) + P8{e') < 5{e fi ), (80) 

a contradiction. □ 

F.5. Proof of Theorem 3 

Proof of Theorem 3. Given a problem (N, M, 5), there exists a finite set of supporting 
manipulability bounds 


£ 0 = 0 < Ei < ... < £r -i < £k = £, 


(81) 


such that for any k e {1,..., K) and any e e \e k _ i, e k ] with f3 = l k ll h 1 we have that 

OPT(e) = (1 - ^)OPT(e fc _i) + /30PT(£ fc ), (82) 

H £ ) = (1 ~ fd)5{e k - 1) + (3d(£ k ). (83) 


From Section 6 we know that for each £ e [0, e] we can write Opt(£) as the set of 
solutions to a linear program, i.e., 


Opt(£) = argmin (v, x) 

X 

s.t. Dx < d, 

Ax ^ £, 


(84) 

(85) 

( 86 ) 


where D and A are matrices, v and d are vectors, £ is a vector with all entries equal to 
£, and x is a vector of variables of dimension L. Observe that £ enters the constraints 
only as the upper bound in a number of linear inequalities. The proof utilizes this 
characterization of Opt(£). 

Before we proceed with the proof of Theorem 3, we require a number of definitions. 
We denote by F e the set of feasible points at £, i.e., 


F e = 


{x | Dx s$ d, Ax ^ £} , 


(87) 
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and we denote by S £ the set of solutions at e, i.e., 


S £ = argmin (v, x) . (88) 

xe f e 

A constraint is a row C\ of either the matrix A or the matrix D with the corresponding 
bound q equal to respective entry of d or e. A feasible point x e F e is an extreme point 
of F e if there exist L independent constraints C\,... ,Cl such that 


C t x = ci (89) 

for all / e {1,..., L}, i.e., the constraints are satisfied with equality at x. x is then said to 
be an extreme point of F e with respect to (Ci, ... ,Cif). We say that the set of constraints 
(Ci,..., Cl) is restrictive at e if they are independent and there exists an extreme point 
in F e with respect to these constraints. Let 

71(e) = {(Ci,..., C L ) | (Ci,..., Cl) is restrictive at e} (90) 

be the set of all sets of constraints that are restrictive at e. A set of restrictive constraints 
C 6 71(e) is binding at e if the extreme point x e F e where the constraints of C are 
satisfied with equality is a solution, i.e., x e S £ . Let 

B(e) = {Ce 71(e) \ C is binding at e} (91) 

be the set of all sets of constraints that are binding at e. We denote by E(F e ) and E(S e ) 
the extreme points of F e and S £ , respectively. 

Observe that since F e and S £ are polytopes and bounded by finitely many hyperplanes, 
the extreme points E(F e ) and E(S e ) form minimal V-representations of F e and S e (see, 
e.g., p.51ff in (Griinbaum, 2003)). Thus, Conv(E(F e )) = F e and Conv(E(S e )) = S £ . 
Furthermore, since S £ F e , any extreme point of S £ is also an extreme point of F £ , 
i.e., E(S £ ) c E(F e ). Finally, each extreme point is uniquely determined by the set of 
constraints with respect to which it is extreme, i.e., if there exists an extreme point with 
respect to a set of constraints C e 71(e), then this point is unique. 

Claim 5. For e 0 , eq e [0, e\ with £ 0 < e 1; if xq e F £0 and 'X\ e F £1 , then for any 7 e [0,1] 
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and £ = (1 — 7)£ 0 + 757 we have that 


x = (1 - 7 )x 0 + 7 x 1 e F e . (92) 

Proof. By assumption, D k x 0 ^ 4 and D k x\ < 4 for all k. Thus, 

D k {{ 1 - 7)^0 + 7^i) = (1 - l)D k xo + 7-Dfc^i < d k . (93) 

Furthermore, A k x 0 < £0 and A k x 1 < £1 for all k, which implies 

A k ((l - 7 )x 0 + 7 x 1 ) = (1 - 7)4,x 0 + 'fAkXi (1 - 7)£ 0 + 7 £ i = £■ (94) 

□ 

Claim 6 . For £ 0 ,£i e [0,£] with £ 0 < £ 1 , if C e 72.(£ 0 ) and C e 77 (£i), f/ien /or any 
7 e [0,1] and £ = (1 — 7)£ 0 + 7 £i we Ziare that C e 1Z (e), and the 7 - convex combination 
of the extreme points at £ 0 and £1 with respect to C is the unique extreme point at e with 
respect to C . 

Proof. Since C e 7Z(£q) and C e TZ(ei), there exist unique extreme points xq e E(F eo ) 
and X! e E(F eo ) with respect to C. By Claim 5, the point x = (1 — 7 )x 0 + 7 x 1 is feasible 
at £. For any l e {1,..., L] if Q = D k for some A; we have that 

C\x = (1 - 7 ) AcX 0 + 7 -DfcXi = (1 - 7)4 + 74 = 4 = c-i, (95) 

i.e., x satisfies the constraint Ci with equality. If C) = A*,, then the constraint is also 
satisfied with equality, since 


Cix = (1 - 7)4.x 0 + 7^4fcXi = (1 - 7)^0 + 7 £ i = £■ (96) 

Consequently, x is the unique extreme point at £ with respect to C. This in turn implies 
that C is restrictive at e. □ 

Claim 7. There exists a finite decomposition 

0 = £ 0 < £1 < ... < £r = £ (97) 
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of the interval [0, £], such that on each interval [^_i, £*,] we have that 71(e) = 7 Z(e') for 
all £,e' £ [e k -i,£k\- 

Proof. By Claim 6 , if some set of L independent constraints C is restrictive at some 
e e [0,£], then the set of e’ £ [0, et] where C is also restrictive must be compact interval 
[£^,,£^] [0,£] with £ £ [£^,£^]. Since there is a finite number of constraints, there is 

also a finite number of constraint sets C. Consider the set 

{e 0 ,...,e K } = IJ (98) 

C set of L indep. constraints 

Observe that by construction, a set of L independent constraints C becomes restrictive 
or un-restrictive only at one of the finitely many £ k -i- This proves the claim. □ 

Claim 8 . On each interval [ek-i, £/.-] from Claim 7 and for any e £ [£*_]_, £*], if C £ 71(e), 
then C £ 7Z(ek-i) n 7 Z(e k ). 

Proof. Assume towards contradiction that C £ 71(e), but C f TZ(ek-i). Then there 
exists an s’ £ (£*,_!,£) c: (£k-i,£k), where C become restrictive for the first time. Then 
e! £ {£o, £k- 1 }, and therefore \e k - 1 , £ k \ cannot be one of the intervals in the decomposition. 
Instead, it would be split by e', a contradiction. □ 

Claim 9. On each interval [£*,_!,£*,] from Claim 1 and for any 7 £ [0, 1] with e = 
(1 — 7 )£fc_i + 7 £ k we have that 


F e = ( 1 - + 7 F £k , (99) 

i.e., the set of feasible points at e is equal to the 7 - convex combination of feasible points 
at e k — 1 and e k . 

Proof. By Claim 5 we have 


Fe 3 (1 - 7)i r e fc _ 1 + 7 F ek . (100) 

By Claim 8 the extreme points of F e are the 7 -convex combinations of extreme points of 
F £fc _ 1 and F £k . Since F e = Conv(E(F e )), this implies 

Fe ^ (1 - l)Fe k ^ + 7 F £k , ( 101 ) 


65 


which concludes the proof of the claim. 


□ 


Claim 10. On each interval [£*,_!,£*.] from Claim 7, if C £ 13(e) for some e £ (£*._!, £ fc ), 

then C £ £>(£*,_ 1 ) n £>(£*,). Furthermore, the extreme point of S £ with respect to C is 

the 7 -convex combination of the extreme points of S £kl and S £k with respect to C with 
_ e-efc-i . 

' £fc — £k — 1 

Proof. Since C £ /5(e), there exists a unique extreme point x £ E(S e ) such that x is 
extreme at e with respect to C. By Claim 9, we can represent x = (1 — 7)^0 + 7 x 1 
with xo e F £fc _ 1 , xi £ F £k . By Claim 6, Xo and xi are extreme points of F £fc _ l and F Sk , 
respectively. 

Suppose towards contradiction that x 0 ^ S' Efc _ 1 . Then there exists x' 0 £ S £k _ 1 such that 


<u, x' 0 ) < <u, x 0 > . (102) 

By Claim 5, x' = (1 — 7 )xq + 7 x 1 is in F e and 

(v,x') = (1 — 7) ("C Xq> + 7 (x, xi> (103) 

< (1 - 7 )<u,x 0 ) + 7 <u,xi> (104) 

= <v,x>, (105) 


i.e., x’ is feasible at £ and has lower objective than x. This contradicts the assumption 
that x £ S £ . A similar argument yields Xi £ S £k , which concludes the proof of the 
claim. □ 

Claim 11. On each interval [£*,_!, £*,] from Claim 1 and any 7 £ [0,1] with e = 
(1 — 7 )£fc_i + 7 £k we have that 


S £ = (1 - 7)^-1 +lS £k , (106) 

i.e., the set of solutions at e is equal to the 7 - convex combination of solutions at £k-i 
and £fc. 

Proof. By Claim 5 we have 


S £ ^(l- 1 )S Ek _ 1+1 S Ek . 


(107) 
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By Claim 10 the extreme points of S e are the 7 -convex combinations of extreme points 
of S £kl and S £k . Since S e = Conv(E(S e )), this implies 

S E c (1 - 7 ) 5 ^ +'ySs k , (108) 

which concludes the proof of the claim. □ 

Claim 11 is the main step in the proof of Theorem 3: every solution x e S e corresponds 
to some optimal mechanism ip e OPT(e). Furthermore, by the nature of the representation 
of mechanisms in the linear program, the convex combination of two solutions corresponds 
to the hybrid mechanism of the two mechanisms. Thus, 

S £ = (1 “7)S efc _! +lS Ek , (109) 

implies 

OPT(e) = (1 - 7)OPT(£ fc _i) + 70PT(£ fc ). (110) 

Since the objective value d is a variable in the solution, we get 

<5(e) = (1-7)<5(e fc _i)+7<5(e fc ). (Ill) 

□ 


F.6. Proof of Proposition 4 

Proof of Proposition f. In a problem (. N , M, 5 Plu ) with n = 3 agents, m = 3 alternatives, 
strict preferences, and where <5 Plu is the worst-case d PLU -deficit, the following hold: 

1. The Pareto frontier has two supporting manipulability bounds 0 and 1/3. 

2. Random Dictatorship is a representative of Opt(O). 

3. Uniform Plurality is a representative 0 /Opt(1/3). 

We first prove that Random Dictatorship is optimal at £q = 0. Since Random 
Dictatorship is by construction a lottery of unilateral, strategyproof mechanisms, it is 
obviously strategyproof. At any preference profile where all agents have the same first 
choice, Random Dictatorship will select this alternative and achieve zero deficit. At any 
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preference profile where all agents have different first choices, all alternatives have the 
same d PLU -value and therefore, any outcome has zero deficit. Finally, consider the case 
where two agents agree on a first choice, a say, but the third agent has a different first 
choice, 6 say. In this case, selecting a would yield a maximal d PLU -value of |. However, 
Random Dictatorship will only select alternative a with probability | and b otherwise. 
This leads to an outcome with d PLU -value of|-| + |- | = |, and therefore, the deficit of 
Random Dictatorship is |. 

It remains to be shown that any strategyproof mechanism will have a deficit of at least 
f. Following the discussion of the second takeaway from Theorem 2 in Section 7, we can 
restrict our attention to mechanisms p that are strategyproof, anonymous, and neutral. 
By Theorem 4, p has a symmetric decomposition, i.e., it can be represented as a lottery 
over neutral, strategyproof unilaterals and anonymous, strategyproof duples. Suppose, 
it contains a some anonymous, strategyproof duple dup afe . By the characterization 
of strategyproofness via swap monotonicity, upper invariance, and lower invariance 
(Theorem 1 in (Mennle and Seuken, 20176)), it follows that the outcome of dup afe can 
only depend on the relative rankings of a and 6, so that dup a b has the form 


dup a,b( P ) 


(P3, 1 - P3, 0) , if Pi 
(P2,l-P2,0), if Pi 
(Pi, 1 — Pi, 0), if Pi 
(p 0 ,1 - Po, 0), if Pi 


: a > b for all agents i, 

: a > b for two agents i, 
: a > b for one agents i, 
: a > b for one agents i, 


( 112 ) 


where the vector (p, 1 — p, 0) = (p a (P), p> b (P), (p c (P)) denotes the outcome and p 3 ^ 
p 2 ^ \ and Po < Pi ^ Again by symmetry of the symmetric decomposition, it 
must also contain the anonymous duple dup“ 5 for any permutation of the alternatives 
w : M —> M. Consider the preference profile 


Pi : 

a > b > c, 

(113) 

Pi : 

a > c > 6, 

(114) 

P 3 ■■ 

b > c> a. 

(115) 


The following table shows what outcomes of the different duples {dup^ | vd : M —> 
M permutation} at this preference profile. 




Duple 

a 

b 

c 

dup a ,b 

P2 

1 

to 

0 

dup„ )C 

P2 

0 

1 ~P 2 

dup h ,c 

0 

P2 

1 -P2 

dup b,a 

1 ~P\ 

Pi 

0 

dup ca 

1 ~P\ 

0 

Pi 

dup C)6 

0 

1 - p\ 

Pi 


A uniform lottery over these duples assigns probability 2 • | = | to alternative b. Since 
Pi ^ P2, this mechanism selects an outcome with d PLU -value at most § ' § + | ' | = §■ 
Since the best alternative a has d PLU - value the mechanism must have a deficit of 
at least | at this particular preference profile. This is the same deficit that Random 
Dictatorship has at this profile, which means that including any strategyproof duples in 
the symmetric decomposition will not improve the deficit of <p(P)- 

Suppose now that the symmetric decomposition of p contains a neutral, strategyproof 
unilateral uni,. As before, it follows that U{ must pick an outcome (pi,P2, 1 — Pi — P2) 
where p\ ^ p 2 ^ 1 —pi —P 2 - Again by symmetry of the symmetric decomposition, it must 
also contain the neutral unilateral uni?" for any permutation of the agents n : N —* N. 
Consider the same preference profile as before, with 


Pi : a > b > c, 

P -2 : a > c > b, 

P 3 : b > c > a. 


(116) 

(117) 

(118) 


The following table shows what outcomes the different unilaterals {unif | 7r : iV —> 
N permutation} will select. 


Unilateral 

a 

b 

C 

uni 1 

Pi 

P2 

1 -P1-P2 

uni 2 

Pi 

i— 1 

to 

P2 

uni 3 

I-P 1 -P 2 

Pi 

P2 


A uniform lottery over these unilaterals assigns probability | to alternative 6 , and 
consequently, this mechanism has a deficit of at least | at this profile. This is the same 
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deficit that Random Dictatorship has at this profile, which means that including any 
strategyproof unilaterals in the symmetric decomposition will not improve the deficit of 

v(P)- 

Since for all mechanisms the worst-case deficit was attained at the same preference 
profile, there exists no strategyproof, anonymous, neutral mechanism that has a lower 
deficit at P than |, and therefore, Random Dictatorship has minimal deficit among all 
strategyproof mechanisms. 

Next, we show that the manipulability of Uniform Plurality is minimal among all d PLU - 
maximizing mechanisms. Without loss of generality, we restrict attention to anonymous, 
neutral, and d PLU -maximizing mechanisms. At any preference profile where an alternative 
is ranked first by two agents or more, this alternative is implemented with certainty. 
Thus, if two agents have the same first choice, the third agent has no opportunity to 
manipulate, because it cannot change the outcome. The two agents with the same first 
choice are already receiving their favorite outcome, which makes manipulation useless 
for them as well. 

Thus, any manipulability will arise at a preference profile where all agents have different 
first choices. Consider the preference profile P with 


Pi : 

a > b > c, 

(119) 

P-2 ■■ 

b > c > a, 

(120) 

P 3 - 

c > a > b. 

(121) 


Renaming the alternatives is equivalent to renaming the agents. Thus, an anonymous 
and neutral mechanisms has to treat all alternatives equally and must therefore select 
each alternative with probability |. Now suppose that agent 1 is almost indifferent 
between a and b, but strongly dislikes c, i.e., its utility function is “close to” the binary 
utility u(a ) = u{b ) = 1 ,u(c) = 0. Then, by swapping a and b , agent 1 can enforce the 
implementation b with certainty. Its gain from this manipulation is close to 

1 • u(b) - ^ (u(a) + u(b) + u(c )) = (122) 

Thus, any d PLU -maximizing mechanism will have manipulability e(<p) ^ |. 

Now consider the Uniform Plurality mechanism. At the above preference profile agents 
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cannot change the outcome, unless they change their first choice. By anonymity and 
neutrality, it suffices to show that agent 1 cannot do any better than / by manipulating. 
However, the only other possible misreport that has any effect on the outcome is to 
bring c forward and enforce it as the outcome, which would yield no benefit for agent 1. 
Consequently, Uniform Plurality has minimal manipulability of /. 

Finally, we show that there are no additional supporting manipulability bounds besides 
0 and 1/3. So far we have that Random Dictatorship is in Opt(O) with a deficit of 
5(0) = /. Furthermore, Uniform Plurality is in Opt(1/3) and no d PLU -maximizing 
mechanism has strictly lower manipulability. To complete the proof, we will show that 
for e = /, all optimal mechanisms have deficit By convexity of the mapping e i—> 6(e), 
the signature of the Pareto frontier must therefore be a straight line between (0,1/9) 
and (1/3,0). Considering the performance guarantees for hybrid mechanisms (Theorem 
2), this implies optimality of the hybrids of Random Dictatorship and Uniform Plurality. 

Suppose that <p is /-approximately strategyproof, anonymous, and neutral. It follows 
from anonymity and neutrality that at the preference profile 

Pi : a > b > c, (123) 

Po : b > c > a, (124) 

P 3 : c > a > b, (125) 

the outcome must be (/, /, /) for a, b, c, respectively. If agent 1 changes its report to 

P[ : b > a > c, (126) 

the outcome changes to (/ — e a , / + e a + £ c , / — e c ) for some values e a ^ |,£ c ^ /. 
Suppose now that agent 1 has a utility close to indifference between a and b , i.e., close 
to u(a) = u(b) = 1 ,u(c) = 0. Then the utility gain for agent 1 from misreporting P[ is 
(arbitrarily close to) 


1 • ( 1-a) + 1 • fea + £c) + 0 • ( _ £ c ) ^ ^c- 


(127) 


If the mechanism is /-approximately strategyproof, then e c ^ /. The d PLU -value of tp(P') 
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at P'= (P[,P 2 ,P 3 ) is 


< v (p'),<i p “(-,p')> = <a,(p') ■ o + MV) ■ l + fc(P') ■ l 


2 / 

1 1 

1 

= - 

— T £ n T £ r I 

+ “ 

3 \ 

v 3 - a -y 

3 

6 

4 1 


— - 

T —£ n -\- —£ n 


18 

6 3 


6 

4 1 

11 

< — 

T — T — — 

— 

18 

18 18 

18' 




(128) 

(129) 

(130) 

(131) 


However, the only d p, '"-niaximizing alternative at P' is b with d PLV (b,P r ) = | = ||. 
Thus, any ^-approximately strategyproof mechanism must incur a deficit of at least 


F.7. Proof of Proposition 5 

Proof of Proposition 5. In a problem (IV, M, 5 Vet0 ) with n = 3 agents, m = 3 alterna¬ 
tives, strict preferences, and where ^ Vet0 is the worst-case d Veto -deficit, the following 
hold: 

1. The Pareto frontier has four supporting manipulability bounds 0, 1/21, 1/12, 1/2. 

2. Random Duple is a representative of Opt(O). 

3. Uniform Veto is a representative of Opt(1/2). 

4- Hybrids of Random Duple and Uniform Veto not optimal for f3 s (0,1/2). 

First, we prove that Random Duple is optimal at £q = 0. Since it is a lottery over 
strategyproof duple mechanisms, it is obviously strategyproof. 

At any preference profile where all agents agree on the last choice, Random Duple 
selects one of the other alternatives, each of which gives maximal d VETO -value. At any 
preference profile where all agents have different last choices, any outcome has zero 
deficit. Finally, consider a preference profile with 

Pi,P 2 : ■ ■ ■ > c, (132) 

P 3 : ...>b. (133) 
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The c? V et0 -value of a is 1 and the d VET0 -value of b is so that the maximum d VET0 -value 
is 1. The worst case for Random Duple is that agents 1 and 2 rank b first, in which 
case a will be selected with probability | and b with probability |. Thus, the deficit of 
Random Duple at P is 



2 2 
3 ’ 3 


2 

9' 


(134) 


In particular, this deficit is attained by Random Duple at the preference profile P with 


Pi, P 2 : b > a > c, 

P 3 : c> a > b. 


(135) 

(136) 


It remains to be proven whether any strategyproof, anonymous, neutral mechanism p 
can achieve a lower deficit (where anonymity and neutrality are without loss of generality, 
similar to the proof of Proposition 4). Consider the preference profile P and let uni,; be 
a strategyproof and neutral unilateral component in the symmetric decomposition of 
p. uni,; must pick an outcome (pi,P2, 1 — Pi — p 2 ) with p 1 ^ p 2 ^ 1 — pi — p 2 , where pk 
denotes the probability of agent V s Ptli choice. The symmetric decomposition implies 
that unii, uni 2 , and unR are equally likely to be chosen. Analogous to the proof of 
Proposition 4, we get 


Unilateral 

a 

b 

c 

unix or uni 2 

Pi 

P2 

1 -PI-P 2 

uni 3 

P'2 

1 

(5 

I 

to 

Pi 


Thus, alternative b is selected with probably at least |, which means that the deficit of p 
at the preference profile P is not reduced by including any unilaterals in the symmetric 
decomposition. 

Similarly, if dup a b is a strategyproof, anonymous duple in the symmetric decomposition 
of ip, it has the form 


du P a ,b( p ) 


(P3, 1 ^ Ps, °), if p i 
(p2 1 1 -P2,0) , if Pi 
(pi, 1 -Pi,0), if Pi 
(Po, 1 - Po, 0), if Pi 


: a > b for all agents i, 

: a > b for two agents i, 
: a > b for one agents i, 
: a > b for one agents i , 


(137) 
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where Pz ^ p- 2 ^ \ and p 0 ^ pi ^ |. Again by symmetry of the symmetric decomposition, 
it must also contain the anonymous duple dup^ b for any permutation of the alternatives 
w : M —* M. The following table shows what outcomes the different duples {dup^ b | w : 
M —*■ M permutation} will select at P. 


Duple 

a 

b 

c 

dup afi 

Pi 

1 - pl 

0 

d ll Pa,c 

P2 

0 

1 p2 

dup bc 

0 

P2 

1 p2 

dup bt a 

1 P2 

P2 

0 

dup ca 

1 - pl 

0 

Pl 

dup C;6 

0 

1 ~P\ 

Pl 


Thus, since p 2 ^ pi, b is selected with probability of at least |, and therefore, including 
any other duples in the symmetric decomposition of p will not improve the deficit at 
P. Consequently, there exists no strategyproof mechanism with a lower deficit than 
Random Duple. 

Next, we show that Uniform Veto has minimal manipulability of among all d VET0 - 
maximizing mechanisms. First, observe that Uniform Veto is ^-approximately strate¬ 
gyproof. To see this, consider the preference profile P 


Pi : 

P2,Pz: 


a > b > c, 

... > c. 


(138) 

(139) 


Uniform Veto selects a and b with probability } each. To manipulate, agent 1 can rank 
b last and obtain a with certainty. Its gain from this manipulation would be 

ui(a) - ^ («i(a) + U! (b)) = ^ (ui(a) - «i(6)), (140) 

which is at- most- \ for Ui(a) = 1 and U\{b) close t-o 0. Thus, the manipulability of 
Uniform Veto is at least }. 

Suppose now that all agent-s have different last- choices. In this case, Uniform Vet-o 
selects any of the alternatives with probability |. By ranking another alternative last, 
an agent could only ensure the implementation of its third choice with certainty, which 
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is not a beneficial manipulation. 

Finally, suppose that two agents have the same last choice, while a third agent has a 
different last choice. We have the following cases from the perspective of agent 1. 

• Case I: 


Pi : 

a > b > c, 

(141) 

P2,P 5 : 

...> a. 

(142) 

In this case, Uniform Veto implements b with certainty. Agent 1 can only enforce 
c by ranking b last, or rank a last and obtain b and c with probabilities | each. 
Neither of these moves will make agent 1 better off. 

Case II: 



Pi : 

a > b > c, 

(143) 

P2,P 5 : 

... > b. 

(144) 

In this case, Uniform Veto implements 

first choice. 

a with certainty, which is 

already agent l’s 

Case III: 



Pi ■■ 

a > b > c, 

(145) 

P 2 : 

• • • > b, 

(146) 

Ps ■■ 

... > c. 

(147) 


In this case, Uniform Veto implements a with certainty, which is already agent l’s 
first choice. 

• Case IV: 


Pi : 

a > b > c, 

(148) 

P 2 : 

...> a, 

(149) 

Ps ■■ 

... > c. 

(150) 
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In this case, Uniform Veto implements b with certainty. By ranking b last, agent 
1 could obtain a probability of | for each alternative instead. Its gain from this 
manipulation is 

^ (m{a) + Mi(6) + «i(c)) - «i(6) ^ (151) 

Further observe that by renaming agents and alternatives, the above cases I through IV 
cover all possible constellations with 2 different alternatives ranked as last choices from 
the perspective of any agent. Thus, Uniform Veto is 1-approximately strategyproof. 

Having shown that the manipulability of Uniform Veto is exactly 1, we now must 
show that any other d VETO -maximizing mechanism p has manipulability e(p) 5= We 
assume without loss of generality that p is also anonymous and neutral, and we consider 
the preference profile 


Pi, P 2 : a > b > c, (152) 

P 3 : b > a > c. (153) 

At this profile, p has to select a with some probability p a and b with probability 1 — p a . If 
p a ^ 1, agent 3 can rank a last and enforce selection of b, the only remaining alternative 
with full d VETO -value. If 113 (b) = 1, w 3 (c) = 0, and u 3 (a) is close to 0, its gain will be 

1 - (1 -Pa) =p a > (154) 

If p a < 1, agent 1 can enforce a by ranking b last and obtain a gain of 

1 ~Pa>\ (155) 

with a similar utility function. Thus, any d VET0 -maximizing mechanism has manipulability 
of at least 

Last, we show that the hybrids of Random Duples and Uniform Veto do not lie on the 
Pareto frontier, except for the extreme cases. In fact, the signatures of their hybrids form 
a straight line: observe that the deficit of Random Duple is attained at the preference 
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Algorithm 

£ 

*(e) 

Comment 

FindLower 

0 

2/9 

found s.rn.b. at e = 0 

FindLower 

1/2 

0 


FindLower 

1/4 

1/12 


FindLower 

1/8 

1/8 


FindLower 

1/16 

65/432 


FindLower 

1/32 

13/72 


FindLower 

1/64 

29/144 

found £= 1/64 < £1 

FindBounds 

1/6 

1/9 


FindBounds 

1/18 

25/162 


FindBounds 

3/47 

28/187 


FindBounds 

1/12 

5/36 

found s.m.b. at e = 1/12 and £ = 1/2 

FindBounds 

1/21 

10/63 

found s.m.b. at e = 1/21 


Table 1: Executions of the linear program FindOpt when using FindLower and 
FiNDBoUNDS to determine the Pareto frontier. 


profile P with 


Pi, P- 2 , P 3 : a > b > c. (156) 

Since Uniform Veto is d VET0 -maximizing, its deficit is zero at all preference profiles. 
Consequently, by linearity of the d VET0 -value d ( x , P ) in the outcome x , the deficit of 
any hybrid hp of Random Duple and Uniform Veto is determined by the deficit at P. 
Furthermore, the manipulability of Uniform Veto is highest at the same preference profile 
if agent 1 swaps b and c to enforce a and has a utility close to U\(a) = 1, U\(c) = 0, 
and U\(b) close to 0. This misreport leaves the outcome of Random Duple unchanged. 
Therefore, the manipulability of any hybrid will also be determined by this preference 
profile and this potential misreport. By linearity of the incentive constraints from 
Theorem 1 it is evident that the signatures of the hybrids of Random Duple and Uniform 
Veto for a straight line between the signatures (0,2/9) and (1/2,0) of the respective 
component mechanism. Consequently, if the Pareto frontier is not linear, then these 
hybrids will not be on the Pareto frontier for any j3 # 0,1. 

To find the supporting manipulability bounds of the Pareto frontier, we used the 
algorithm FindLower to determine a lower bound for the smallest non-zero supporting 
manipulability bound and then applied FindBounds with this value of e. Table 1 gives 
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Preference Profile 

e 1 = 1/21 

s 2 = 1/12 

Pi 

P 2 



p 



a 

b 

c 

a 

b 

c 

a 

> 

b 

> 

c 

a 

> 

b 

> 

c 

a 

> 

b 

> 

c 

11/21 

3/7 

1/21 

7/12 

1/3 

1/12 

a 

> 

b 

> 

c 

a 

> 

b 

> 

c 

a 

> 

c 

> 

b 

4/7 

3/7 

0 

2/3 

1/4 

1/12 

a 

> 

b 

> 

c 

a 

> 

b 

> 

c 

b 

> 

a 

> 

c 

11/21 

10/21 

0 

1/2 

1/2 

0 

a 

> 

b 

> 

c 

a 

> 

b 

> 

c 

b 

> 

c 

> 

a 

10/21 

11/21 

0 

5/12 

7/12 

0 

a 

> 

b 

> 

c 

a 

> 

b 

> 

c 

c 

> 

a 

> 

b 

4/7 

8/21 

1/21 

2/3 

1/3 

0 

a 

> 

b 

> 

c 

a 

> 

b 

> 

c 

c 

> 

b 

> 

a 

10/21 

11/21 

0 

5/12 

7/12 

0 

a 

> 

b 

> 

c 

a 

> 

c 

> 

b 

a 

> 

c 

> 

b 

4/7 

0 

3/7 

2/3 

1/12 

1/4 

a 

> 

b 

> 

c 

a 

> 

c 

> 

b 

b 

> 

a 

> 

c 

4/7 

3/7 

0 

7/12 

5/12 

0 

a 

> 

b 

> 

c 

a 

> 

c 

> 

b 

b 

> 

c 

> 

a 

3/7 

8/21 

4/21 

1/3 

5/12 

1/4 

a 

> 

b 

> 

c 

a 

> 

c 

> 

b 

c 

> 

a 

> 

b 

4/7 

0 

3/7 

7/12 

0 

5/12 

a 

> 

b 

> 

c 

a 

> 

c 

> 

b 

c 

> 

b 

> 

a 

3/7 

4/21 

8/21 

1/3 

1/4 

5/12 

a 

> 

b 

> 

c 

b 

> 

a 

> 

c 

b 

> 

a 

> 

c 

10/21 

11/21 

0 

1/2 

1/2 

0 

a 

> 

b 

> 

c 

b 

> 

a 

> 

c 

b 

> 

c 

> 

a 

3/7 

4/7 

0 

5/12 

7/12 

0 

a 

> 

b 

> 

c 

b 

> 

a 

> 

c 

c 

> 

a 

> 

b 

4/7 

8/21 

1/21 

7/12 

5/12 

0 

a 

> 

b 

> 

c 

b 

> 

a 

> 

c 

c 

> 

b 

> 

a 

8/21 

4/7 

1/21 

5/12 

7/12 

0 

a 

> 

b 

> 

c 

b 

> 

c 

> 

a 

b 

> 

c 

> 

a 

1/21 

4/7 

8/21 

0 

2/3 

1/3 

a 

> 

b 

> 

c 

b 

> 

c 

> 

a 

c 

> 

a 

> 

b 

1/3 

1/3 

1/3 

1/3 

1/3 

1/3 

a 

> 

b 

> 

c 

b 

> 

c 

> 

a 

c 

> 

b 

> 

a 

1/21 

4/7 

8/21 

0 

7/12 

5/12 

a 

> 

b 

> 

c 

c 

> 

a 

> 

b 

c 

> 

a 

> 

b 

11/21 

0 

10/21 

7/12 

0 

5/12 

a 

> 

b 

> 

c 

c 

> 

a 

> 

b 

c 

> 

b 

> 

a 

8/21 

4/21 

3/7 

5/12 

1/4 

1/3 

a 

> 

b 

> 

c 

c 

> 

b 

> 

a 

c 

> 

b 

> 

a 

0 

11/21 

10/21 

0 

7/12 

5/12 


Table 2: Optimal mechanisms at ey = 1/21 and £2 = 1/12 (extended to other preference 
profiles via the anonymity and neutrality extension). 


the signatures on the Pareto frontier that were determined using the signature-function 
in the order in which they were computed. 

Table 2 gives two mechanisms that are optimal at ey = 1/21 and £2 = 1/12, respectively. 
For preference profiles that are not listed, rename the agents and alternatives to obtain 
one of the listed preference profiles, and select the respective outcome (renaming the 
alternatives again). □ 
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